The SharePoint Brand That Was Never Registered

The SharePoint Brand That Was Never Registered

A finance mailbox at a mid-size hospitality and tour-operator company received what looked like the most ordinary message in the modern workday: a SharePoint notification saying a document had been shared. The file was titled "Remittance." The sender used a generic personal display name. And when the email hit the tenant, every authentication check a gateway could run came back clean.

SPF passed. DKIM passed with a valid signature. DMARC passed and aligned. The message had traveled across genuine Microsoft infrastructure the entire way. On paper, there was nothing to flag. On paper, this was a colleague sharing a payment file.

The problem was that the brand on the share link had never existed.

The email that authenticated perfectly

Start with what a traditional secure email gateway saw, because a gateway would have waved this through without a second look.

The message originated from a real, aged business domain, one registered nearly two decades earlier and belonging to a legitimate performing-arts venue. That domain published a valid DKIM key and signed the message with it, so the cryptographic signature verified. The envelope path was authorized under SPF. DMARC found alignment and returned a pass. There was no attachment to detonate in a sandbox, no macro, no executable, no obvious redirect chain.

This is the signature of account takeover, not spoofing. Nobody forged this domain from the outside. Somebody was operating a mailbox that genuinely belonged to it. That is precisely why the authentication stack had nothing to say. SPF, DKIM, and DMARC are designed to answer one narrow question: did this message really come from the domain it claims, unaltered? Here the honest answer was yes. Authentication validates plumbing, not intent, and the plumbing was real.

The 2024 Verizon Data Breach Investigations Report puts numbers behind why this matters. Stolen credentials were the single most common initial action in breaches, involved in 38% of them, and the human element featured in 68% of breaches overall. A working, credentialed mailbox is not an edge case for attackers. It is the front door.

A brand that doesn't exist

The lure lived in the share link itself. The notification pointed to a Microsoft personal-share tenant whose subdomain announced a hospitality brand, a name chosen to feel plausible to a company that books travel and tours. The whole pretext leaned on that brand: a familiar-sounding hospitality name attached to a "Remittance" file lands softly in a finance inbox.

So we checked the brand. Not the sending domain, which authenticated, but the hospitality brand the SharePoint tenant was advertising. If a real company by that name owned that tenant, its root domain should exist somewhere in public registration records.

It did not. The brand's matching root domain had never been registered at all. No registrar record, no creation date, no privacy shield, nothing. The name existed only as a label bolted onto a SharePoint subdomain, dressed up to look like a corporate cloud tenant. A brand that has never registered its own domain is not a brand. It is a costume.

The tell hidden in the share link

The mismatch went one layer deeper, and it was baked into the link's own structure.

Microsoft personal-share URLs embed the true account owner in their path. The tenant wrapper displayed the invented hospitality brand, but the personal-share path fragment named the actual mailbox that owned the shared item, and it was not the hospitality brand at all. It was a lighting account at the performing-arts venue whose compromised mailbox sent the email in the first place.

Read the two halves together and the story falls apart. The subdomain claimed one hospitality company. The path fragment named a completely unrelated venue mailbox. The same message was telling two different stories about who it came from, and only the boring, technical half, buried in the URL path, was true. The attacker had taken over a real mailbox, stood up a personal SharePoint share from it, and painted a fictional hospitality brand over the top to make the "Remittance" file feel like it belonged in a travel company's inbox.

Why authentication was never going to catch this

Nothing in SPF, DKIM, or DMARC inspects whether a display brand corresponds to a real, registered organization, or whether the brand on a tenant wrapper matches the account owner encoded inside the link. Those checks confirm provenance and integrity. They are silent on identity coherence, and identity coherence was the entire attack.

This is why layered, behavioral detection is not optional. IRONSCALES Adaptive AI flagged this message on signals the authentication stack cannot express: a first-time external sender rated high risk, a claimed tenant brand with no public existence, and the direct contradiction between that brand and the account-owner fragment inside the share path. Themis tagged it as incoming fileshare phishing and scored it on the identity mismatch itself, not on any failed technical check, because there was no failed technical check to lean on.

The deeper lesson is about how these mailboxes get taken over in the first place. This attack rode a legitimate, credentialed account, exactly the outcome that account takeover protection is built to interrupt before a trusted mailbox becomes someone else's launch pad. And because the endgame here is payment fraud dressed as a remittance file, the same mismatch-aware controls that defend against business email compromise are what stand between a routine-looking share notice and a diverted payment.

Authentication told the truth about the plumbing. It just had no way to tell you the brand on the label had never been born.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link: the payload is a cloud file-share link rather than an attachment.
• T1078 Valid Accounts: delivery rode a genuinely compromised, fully authenticated legitimate mailbox.

For the broader pattern, see the 2024 Verizon Data Breach Investigations Report on credential-driven intrusions, MITRE ATT&CK on phishing, and CISA's guidance on stopping the phishing attack cycle.

See You Next Friday

Clean authentication is a statement about origin, not honesty. When a message passes every check and still asks you to trust a brand, look past the plumbing and ask whether the identity actually holds together. Sometimes the whole con is a name that was never real.