Sophisticated Phishing Campaign Using Spoofed Internal Emails and URL Redirection

Initial Signal

On January 2, 2026, user_1@[INTERNAL_DOMAIN_1].local reported a phishing email received on December 17, 2025 — a 16-day gap that exposed a critical detection blind spot. The email, with subject "Action Required: Signature Needed for Payment Processing," appeared to come from an internal sender but originated from [EXTERNAL_IP_1], a VPN endpoint in France hosted by OVH SAS. The phishing URLs employed sophisticated obfuscation: a Google Maps redirect (`maps.google.com.br/url?q=...`) masked the true destination (`evil-acme.com`), and a Base64-encoded tracking parameter in the URL fragment decoded to the victim's email address, revealing a targeted approach. Email cluster analysis identified 19 similar messages with identical body fingerprints (3869896793), confirming a coordinated campaign rather than a one-off attempt. Microsoft 365 Defender marked the URLs as malicious and remediated, but the incident remained in "inProgress" status with "pendingApproval" investigation state. While no successful compromise was detected, the campaign's sophistication and the extended window before reporting represent a significant security concern warranting enhanced email security awareness training.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified the malicious nature of the URLs in the email
   Pass
2. fp2
   Analyzed the email spoofing technique
   Pass
3. fp3
   Evaluated the campaign scope and targeting
   Pass
4. fp4
   Assessed the application-based mailbox access
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. Email spoofing confirmed through header analysis showing sender address (user_1@[INTERNAL_DOMAIN_1].local) matching the recipient, originating from [EXTERNAL_IP_1], a VPN endpoint in France hosted by OVH SAS — inconsistent with legitimate internal infrastructure

2. Malicious URL obfuscation using Google Maps redirect (`maps.google.com.br/url?q=...`) to mask the true destination (`evil-acme.com`), with both URLs marked as malicious and remediated in security alerts

3. Personalized tracking via Base64-encoded parameter in the URL fragment decoding to the victim's email address, indicating targeted, deliberate campaign design rather than mass phishing

4. Campaign scale confirmed by email cluster analysis identifying 19 similar messages with identical body fingerprint

5. demonstrating coordinated, multi-target attack

6. Confidence is High rather than Confirmed because the 16-day detection delay and lack of Microsoft Defender XDR records for email events, attachments, and URL info suggest security controls initially missed the threat, leaving a gap in telemetry that could obscure other indicators of compromise or post-delivery interaction

Lessons

1. 01
   Detection delay is the real threat, not just the email. This investigation revealed a 16-day gap between email receipt (December 17, 2025) and user report (January 2, 2026). During that window, 19 similar phishing emails targeting multiple employees went undetected by automated systems. The email was eventually marked malicious and remediated, but the delay meant the attack had maximum time to succeed. Audit your email security controls: if users are the primary detection mechanism, you've already lost. Implement email cluster analysis and body fingerprint correlation to catch campaign-scale phishing automatically, and set alerts to trigger when identical emails reach multiple users within hours, not days.
2. 02
   URL obfuscation + personalization = high-confidence targeting. The attacker used a Google Maps redirect to hide the destination (evil-acme.com) and embedded a Base64-encoded tracking parameter containing the victim's email address. This combination signals deliberate, targeted attack, not mass phishing. The personalization suggests the attacker had prior knowledge of the target's email address and crafted the campaign specifically for [ORG_1]. When you see redirect URLs with encoded user identifiers, treat it as evidence of reconnaissance and intent. Escalate immediately and check for other indicators of compromise in the target's mailbox and authentication logs.
3. 03
   Email spoofing from external IPs is still spoofing. The phishing email claimed to come from user_1@[INTERNAL_DOMAIN_1].local but originated from [EXTERNAL_IP_1], a VPN endpoint in France. DMARC, SPF, and DKIM should have caught this, but the email was delivered. Verify that your email authentication policies are enforced at the gateway and that spoofed internal addresses are rejected or quarantined, not delivered. If legitimate internal users send from external IPs (remote work, travel), use a separate authentication flow or require additional verification before delivery.
4. 04
   Campaign scope changes the investigation priority. Email cluster analysis identified 19 similar emails with the same body fingerprint. This transforms the investigation from 'one user got phished' to 'we have a coordinated campaign targeting multiple employees.' When you discover campaign-scale phishing, immediately: (1) identify all recipients, (2) check mailbox access logs for clicks or credential entry, (3) review authentication logs for the targeted users during the 16-day window, and (4) assess whether the attacker gained any foothold. The 19-email cluster is your signal to escalate to incident response, not just security awareness training.