Known malicious kithighphishing
Microsoft-auth subdomain labels on non-Microsoft apexes (AiTM infrastructure tripwire)
family: ms-auth-subdomain-label
Forward-looking tripwire for the naming convention the Payroll Pirates AiTM proxies used, rather than for the burned domains themselves. Arctic Wolf observed the proxy tier consistently fronted by a Microsoft-themed leftmost label — mslogin., msonline., msauth. — on a freshly registered, otherwise meaningless apex, with the redirector tier one step back on an idp. label. This anchor catches the next rotation of that convention rather than the last one, which matters here because the published domains were all under ten days old when used and are all now suspended.
Anchors
SMQL queryrun
(domain:mslogin.* OR domain:msonline.* OR domain:msauth.* OR domain:login-microsoftonline.* OR domain:microsoftonline-*) AND -domain:*msauth.net AND -domain:*.microsoft.com AND -domain:*.microsoftonline.comProvenance
Added: 2026-08-10 20:57
Measured before landing, against all 531,005 public scans on 2026-08-10: this anchor matches exactly ONE scan, msauth.o365s.com (2026-07-29) — and o365s.com is itself a Microsoft-lookalike apex whose capture came back as a blank New Tab, i.e. an anti-scanner cloak rather than a false positive. So the practical FP rate is zero and the breadth guard is in no danger. Three labels from the report are deliberately excluded because they were measured and they do NOT hold up: 'idp.' matches 25 distinct hosts, all genuine enterprise identity providers (idp.aa.com, idp.nycenet.edu, idp.shu.ac.uk, idp.bnsf.com ...); 'office.' matches 12, mostly legitimate (office.com, office.mailbox.org, office.dingtalk.com); and 'int.' matches 15 unrelated hosts. Those three labels are only meaningful in this campaign when paired with a Microsoft-branded destination, and SMQL cannot express that pairing, so they are left out entirely rather than shipped noisy. The -domain:*msauth.net exclusion is load-bearing and not cosmetic: msauth.net is a genuine Microsoft CDN apex and the bare hostname would otherwise match the msauth.* branch. All three exclusions sit OUTSIDE the OR group on purpose — a negation inside the disjunction disables pg_builder's UNION rewrite and costs roughly 15x on query time. Validated with validate_ast(parse(q)): 8 filter nodes.