Known malicious kithighphishing
Microsoft-auth subdomain labels on non-Microsoft apexes (AiTM infrastructure tripwire)
family: ms-auth-subdomain-label
Forward-looking tripwire for the naming convention the Payroll Pirates AiTM proxies used, rather than for the burned domains themselves. Arctic Wolf observed the proxy tier consistently fronted by a Microsoft-themed leftmost label — mslogin., msonline., msauth. — on a freshly registered, otherwise meaningless apex, with the redirector tier one step back on an idp. label. This anchor catches the next rotation of that convention rather than the last one, which matters here because the published domains were all under ten days old when used and are all now suspended.
Anchors
SMQL queryrun
(domain:mslogin.* OR domain:msonline.* OR domain:msauth.* OR domain:login-microsoftonline.* OR domain:microsoftonline-*) AND -domain:*msauth.net AND -domain:*.microsoft.com AND -domain:*.microsoftonline.comProvenance
Added: 2026-08-10 20:57
Measured 2026-08-10: this anchor matched a single scan, msauth.o365s.com (2026-07-29). o365s.com is itself a Microsoft look-alike apex, and its capture came back blank, consistent with anti-scanner cloaking rather than a false positive. Three labels from the report are deliberately excluded because they do not hold up: 'idp.' matches many genuine enterprise identity providers (idp.aa.com, idp.nycenet.edu, idp.shu.ac.uk, idp.bnsf.com …), 'office.' matches mostly legitimate hosts (office.com, office.mailbox.org, office.dingtalk.com), and 'int.' matches unrelated hosts. Those labels only mean something in this campaign when paired with a Microsoft-branded destination, which this query cannot express, so they are left out rather than shipped noisy. The msauth.net exclusion matters: msauth.net is a genuine Microsoft CDN apex that would otherwise match the msauth. branch.