The Fake Login That Sends You to the Real Microsoft

An invoice mailbox at a medical-device manufacturer received a routine-looking remittance advice. Every authentication signal was green. The sending domain passed SPF, DKIM, and DMARC, and composite authentication returned a perfect score. To every gateway rule that inspects who sent a message, this email was clean. The one link inside it was not.

The message was a brand-impersonation lure dressed as a secure document from a familiar vendor. Behind its single call to action sat one of the more elegant credential-harvesting tricks we have analyzed: a fake Microsoft sign-in page that, the instant it finished stealing a password, dropped the victim back onto the genuine Microsoft login. No error, no dead page, no reason to suspect anything. This is the fake login that sends you to the real one.

How the Attack Reached the Inbox

The attacker did not spoof a domain or stand up throwaway infrastructure to send the mail. They relayed through SendGrid, a legitimate Email Service Provider (ESP) trusted by thousands of senders. Using a sending domain with valid records, the message passed Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). Composite authentication, the aggregate signal Microsoft uses to summarize sender legitimacy, returned its top score.

That combination is the whole point. A gateway that leans on reputation and authentication sees authorized infrastructure and a fully aligned sender, and waves the message through. The lure itself was generic on purpose. A remittance advice, a secure-document prompt, a vendor brand the recipient would recognize. Nothing about the envelope invited scrutiny.

The Trust-Laundering Redirect

The single malicious call-to-action (CTA) link did the work. Before it went anywhere useful to the attacker, it encoded the exact target recipient address in base64 and carried it as a URL parameter. That gave the operator per-recipient tracking, confirming precisely which mailbox clicked and allowing the destination page to be tailored to the victim.

The link resolved to a privacy-protected, Bulgaria-hosted domain. That page rendered a pixel-faithful Microsoft sign-in screen. A user who typed their password handed it directly to the attacker. Then the page executed a 302 redirect straight to the real outlook.office.com.

This is the laundering step, and it is what makes the attack dangerous. The victim never sees a suspicious page linger. They enter credentials, the browser flashes, and they arrive on a legitimate Microsoft property showing a normal login. To the target it looks like a benign reauthentication that succeeded. Nothing prompts them to reset a password or report anything. The stolen credential can then be used quietly for account takeover or to stage Business Email Compromise (BEC), the fraud pattern the 2024 Verizon Data Breach Investigations Report ties to a median loss of roughly 50,000 US dollars per incident.

Why Authentication Was Not Enough

Clean SPF, DKIM, and DMARC results answer one question: did this message come from infrastructure authorized to send for that domain. They do not answer whether the message is honest. When an attacker rents a slice of a reputable ESP and sends from a properly configured domain, authentication faithfully confirms an authorized sender delivering a malicious payload.

Phishing remains a leading initial-access vector. The 2024 Verizon Data Breach Investigations Report attributes 15 percent of breaches to phishing and finds the human element present in 68 percent of breaches, while the Microsoft Digital Defense Report 2024 documents the continued industrialization of credential theft and phishing-as-a-service. The FBI Internet Crime Report for 2023 records billions in losses tied to BEC and account compromise. The through-line is that identity-layer intent, not envelope authentication, is where these attacks are caught or missed.

In this case, IRONSCALES flagged the link independently of the auth signals. Themis, the Adaptive AI analyst, scored the CTA as malicious at roughly 90 percent confidence. It weighed the mismatch between a vendor-branded lure and a privacy-protected foreign landing domain, the base64-encoded recipient parameter, and the fake-sign-in behavior, none of which the SPF, DKIM, and DMARC checks could see.

MITRE ATT&CK Mapping

• T1566, Phishing. The initial-access vector: a brand-impersonation invoice lure delivered to an accounting mailbox.
• T1566.002, Spearphishing Link. The single embedded CTA carrying a base64-encoded per-recipient parameter, leading to a credential-capture page.

Reference: MITRE ATT&CK T1566 and T1566.002.

Indicators of Compromise

Domains are defanged. Do not click, and treat the recipient-tracking parameter as attacker-controlled.

Detection and Defense

The defensive lesson is to stop treating a green authentication result as a verdict on trust. Detection here depended on evaluating the link and the sender behavior together: a vendor-branded message pointing to an unrelated, privacy-shielded overseas domain, a URL that fingerprints the exact recipient, and a page that behaves like a credential-capture form. Those signals live at the identity and intent layer, which is exactly where Adaptive AI adds value on top of gateway authentication. Guidance from the Cybersecurity and Infrastructure Security Agency reinforces the point that link and behavioral scrutiny, not sender reputation alone, breaks the phishing cycle: CISA phishing guidance.

Practically, that means link-time analysis that follows redirects, per-message intent scoring rather than static allow-lists, and continuous learning from analyst decisions. Explore how IRONSCALES detects these attacks on the platform overview, how it stops credential harvesting, and how it defends against business email compromise.

The Takeaway

Authentication tells you a message came from where it claims. It does not tell you the message is safe. This attack passed every envelope check, tracked its victim, stole a credential, and then hid the theft by handing the target back to the real Microsoft login. The only thing that caught it was analysis of what the link actually intended to do.