hxxps://login[.]microsoftonline[.]com/common/oauth2/v2[.]0/authorize?supportContact=support%40amazon[.]com&idp_version=1[.]9&perf_tier=ultra&partnerID=ORBIT-LINK&launch_context=silent&brightness_mode=dark&deviceModel=iPad&device_type=tablet&payload_mode=encrypted&feature_flag=aifeature-55&utm_medium=email&session_quality=fluctuating&load_strategy=progressive&render_mode=dynamic&beta_mode=enabled&pipeline_stage=canary&region=SEA&integrationID=AI2025-Q4-Launch&login_mode=seamless&token_type=refresh&tracking_group=engagement_Q4&ui_pack=classic-ui&channel_id=widget_beta_v3&utm_campaign=launch2025&geo_hint=LATAM&graph_version=beta&compliance_mode=hipaa&cache_mode=fast&cdn_provider=Fastly&lang=pt&session_vector=v3&os_version=macOS14[.]2&platform_type=desktop&engine_variant=go_fast&device_orientation=landscape&risk_score=unknown&env=prod&access_level=premium&pipeline_id=stack-112&sync_mode=adaptive&ref_mid=9191b32a90309d69c6c076f1cc468173&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph[.]microsoft[.]com%2FUser[.]Read&prompt=none&client_id=123df4bf-0496-4c87-a806-d6d7f6f40ec3&state=cnVzc0BybGpvbmVzLmNvbQ==

General

Target
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?supportContact=support%40amazon.com&idp_version=1.9&perf_tier=ultra&partnerID=ORBIT-LINK&launch_context=silent&brightness_mode=dark&deviceModel=iPad&device_type=tablet&payload_mode=encrypted&feature_flag=aifeature-55&utm_medium=email&session_quality=fluctuating&load_strategy=progressive&render_mode=dynamic&beta_mode=enabled&pipeline_stage=canary&region=SEA&integrationID=AI2025-Q4-Launch&login_mode=seamless&token_type=refresh&tracking_group=engagement_Q4&ui_pack=classic-ui&channel_id=widget_beta_v3&utm_campaign=launch2025&geo_hint=LATAM&graph_version=beta&compliance_mode=hipaa&cache_mode=fast&cdn_provider=Fastly&lang=pt&session_vector=v3&os_version=macOS14.2&platform_type=desktop&engine_variant=go_fast&device_orientation=landscape&risk_score=unknown&env=prod&access_level=premium&pipeline_id=stack-112&sync_mode=adaptive&ref_mid=9191b32a90309d69c6c076f1cc468173&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&client_id=123df4bf-0496-4c87-a806-d6d7f6f40ec3&state=cnVzc0BybGpvbmVzLmNvbQ==
Sample261027-t7bddss16r

Score

10^/10

Malware Config

Targets

- Target
  https://login.microsoftonline.com/common/oauth2/v2.0/authorize?supportContact=support%40amazon.com&idp_version=1.9&perf_tier=ultra&partnerID=ORBIT-LINK&launch_context=silent&brightness_mode=dark&deviceModel=iPad&device_type=tablet&payload_mode=encrypted&feature_flag=aifeature-55&utm_medium=email&session_quality=fluctuating&load_strategy=progressive&render_mode=dynamic&beta_mode=enabled&pipeline_stage=canary&region=SEA&integrationID=AI2025-Q4-Launch&login_mode=seamless&token_type=refresh&tracking_group=engagement_Q4&ui_pack=classic-ui&channel_id=widget_beta_v3&utm_campaign=launch2025&geo_hint=LATAM&graph_version=beta&compliance_mode=hipaa&cache_mode=fast&cdn_provider=Fastly&lang=pt&session_vector=v3&os_version=macOS14.2&platform_type=desktop&engine_variant=go_fast&device_orientation=landscape&risk_score=unknown&env=prod&access_level=premium&pipeline_id=stack-112&sync_mode=adaptive&ref_mid=9191b32a90309d69c6c076f1cc468173&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&client_id=123df4bf-0496-4c87-a806-d6d7f6f40ec3&state=cnVzc0BybGpvbmVzLmNvbQ==
Score

7^/10

microsoft discovery phishing
- A potential corporate email address has been identified in the URL
  phishing
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
behavioral1