Phishing Infrastructure and Suspected Mailbox Compromise

Classification (TLP): AMBER

Case name: Phishing Infrastructure and Suspected Mailbox Compromise
Prepared by: Helicon Nova
Document type: Redacted incident investigation case study
Version: v1.3, analytical revision of v1.2
Original report date: 2025-09-08 (UTC)
Editorial review date: 2026-09-12. No new incident evidence was collected for this revision.

Case-study redactions: The affected employee and client organization are referred to as Employee A and Organization A. The mailbox address is a placeholder; identifying email filenames and the message ID have been redacted.

Scope

The investigation covers a QR lure, email headers, selected Microsoft Entra ID (formerly Azure AD/AAD) sign-in screenshots, and phishing-related page, DNS, certificate, and network observations. Referenced infrastructure includes rouleafrai.sa.com, geayioroo.sa.com, vadreaje.sa.com, chouracea.sa.com, and apps-house.com.

Mailbox compromise, unauthorized MFA changes, and the relationship between the QR destination and the observed sites remain investigation questions. Endpoint forensics, banking telemetry, and organization-wide scoping were not available.

Evidence basis and constraints

• This case-study package contains the narrative and artifact catalog. Referenced original screenshots, emails, logs, and captured source files are not included here and were not independently re-examined for this revision.
• Evidence labels describe the existing investigation record. The catalog records hashes and sizes for some artifacts; it does not establish a complete chain of custody or validate every original file.
• Full sign-in exports, DirectoryAudit records, mailbox audit logs, and a complete Conditional Access policy export are missing. These gaps limit conclusions about account use, MFA changes, access controls, and impact.
• The forwarded email is cataloged as E-002. The record documents a user-requested transfer for analysis; exact timing still requires header verification.
• Times are UTC where known. Approximate or date-only entries are identified in the timeline; file modification times and certificate dates are not treated as proof of an attack start time.
• Infrastructure observations are historical. Current site availability, containment, and remediation have not been verified.

The investigation record documents a QR lure, email authentication failures, login-page impersonation, and an obfuscated JavaScript loader. These findings support a phishing investigation. They do not establish that Employee A submitted credentials, that an attacker used the mailbox, or that an MFA method was changed.

• CONFIRMED observation: The email header records SPF softfail, DKIM none, DMARC fail, and connecting IP 162.19.130.136. These results do not by themselves prove mailbox compromise. (E-001)
• CONFIRMED observation: The record identifies a QR-only DOCX, a carved QR bitmap, and recorded file metadata/hashes. Delivery as initial access or after an earlier compromise is unresolved. (E-003/E-004)
• CONFIRMED in the investigation record: Employee A forwarded the lure at the investigator's request. The recorded purpose is evidence transfer; this event is not treated as attacker exfiltration. Exact send time remains unverified. (E-002)
• CONFIRMED observation: The sign-in screenshots show MFA satisfied by an existing claim. POSSIBLE hypothesis: unauthorized account/session use; evidence does not distinguish this from legitimate use. (E-007/E-008)
• POSSIBLE hypothesis: Unauthorized MFA enrollment or alteration, based on the reported concern. No DirectoryAudit export is available to establish a change, its actor, or its authorization.
• CONFIRMED observation: Captured views show Security Defaults disabled. Whether other policies enforced MFA or restricted access is unresolved. (E-009)
• CONFIRMED observation: Login impersonation and source code implementing AES-GCM decryption, dynamic evaluation, and clipboard restrictions are documented. Credential-harvesting intent is LIKELY; successful collection from Employee A is unverified. (E-017/E-026)
• CONFIRMED observation: Network records reference geayioroo.sa.com and chouracea.sa.com. Collector roles are POSSIBLE hypotheses; the available summaries do not establish transmitted credential content or successful exfiltration. (E-015/E-016)
• CONFIRMED observation: DNS, certificates, redirects, errors, and Cloudflare-related responses are cataloged. Shared infrastructure and protocol behavior alone do not establish maliciousness or common ownership. (E-010/E-011/E-012/E-013/E-014/E-019/E-020/E-021/E-022/E-024/E-025)

Risk assessment: Potential consequences include mailbox data exposure, BEC, and access to connected applications if account compromise occurred. Actual impact and residual risk cannot be determined from the available record.

Outcome: The investigation produced an artifact inventory, a timeline, infrastructure observations, and prioritized collection/response recommendations. No completed containment, takedown, recovery, financial-loss assessment, or incident closure is documented. See the outcome and action-status summary.

The record combines two lines of inquiry: phishing-related infrastructure and Employee A's email/identity events. Captured login impersonation and loader code support the phishing assessment. The technical chain from the QR lure to a particular site, and from any site interaction to account access, remains incomplete. (E-001/E-003/E-004/E-016/E-017/E-026)

DevTools and network summaries identify requests involving rouleafrai.sa.com, geayioroo.sa.com, and chouracea.sa.com. Additional DNS, certificate, and web observations provide context for vadreaje.sa.com and apps-house.com. Associations are scoped to the cited observations; common operation of all domains is not established.

The catalog describes an AES-GCM loader with reconstructed key/IV material, TextDecoder use, and dynamic JavaScript evaluation. GeoJS requests are also documented. Geo-based access gating is a hypothesis until the relevant conditional logic or controlled behavior is demonstrated. (E-016/E-026)

The QR lure's role in the intrusion sequence is unresolved. Earlier sign-in timestamps alone do not establish an earlier compromise, so this report does not classify the lure as post-compromise activity.

Account in scope

Employee A at Organization A; mailbox placeholder: user@example.invalid.

• Two sign-in events are represented in screenshots dated 2025-08-30 and 2025-09-01. The captured MFA result is confirmed as an observation; the person controlling each session is undetermined. (E-007/E-008)
• The inbound lure header records authentication failures on 2025-09-05. The record also describes an authorized forward for analysis. (E-001/E-002)
• The QR-only artifact Bonus-package-<redacted>.docx and carved bitmap are cataloged. Related campaign samples provide comparison material, not proof of execution on this client's devices. (E-003/E-004/E-006)
• Unauthorized MFA changes are POSSIBLE and require audit evidence. A tenant-wide weakness cannot be inferred solely from the disabled Security Defaults setting. (E-009)

Chronology combines account events, file metadata, and infrastructure observations. An earlier event is not necessarily an earlier intrusion stage. Appendix B identifies timestamp precision and evidence limits.

• 2025-08-30T16:55:48Z and 2025-09-01 (time unknown): Sign-in captures show MFA previously satisfied; authorization is unresolved. (E-007/E-008) CONFIRMED observation.
• 2025-09-05T14:11:48Z: Inbound header records SPF softfail, DKIM none, DMARC fail, and CIP 162.19.130.136. (E-001) CONFIRMED observation.
• 2025-09-05T17:39:11Z (20:39:11+03:00): Recorded local file modification time for the QR lure. This does not independently establish delivery, opening, or QR scanning time. (E-003) CONFIRMED metadata observation.
• 2025-09-05, approximately 19:06Z: User-requested forward to the investigator's Gmail. (E-002) CONFIRMED event in the record; timestamp is approximate pending header verification.
• 2025-09-06 to 2025-09-07: Browser and network captures reference impersonation assets, loader behavior, GeoJS requests, and investigated domains. Request roles and client interaction require further validation. (E-016/E-017/E-021/E-022)
• 2025-09-07 (time unknown): Certificate chain and OCSP status recorded for chouracea.sa.com. These observations concern certificate state at collection, not proof of credential collection. (E-024)

ATT&CK mappings describe supported behaviors or explicit investigation hypotheses. A mapping does not establish execution on Employee A's device or successful account compromise.

• T1027 - Obfuscated Files or Information: CONFIRMED source-level observation of encrypted loader material and obfuscation. (E-016/E-026)
• T1059.007 - JavaScript: CONFIRMED source-level implementation of decryption followed by dynamic evaluation. Execution in a client session and its downstream effects are unverified. (E-026)
• T1566.001 - Spearphishing Attachment: LIKELY mapping for the email-associated QR lure. The original inbound EML and full attachment relationship should be validated. (E-001/E-003/E-004)
• T1566.002 - Spearphishing Link: POSSIBLE mapping for the QR destination. The destination and redirect chain have not been verified. (E-004)
• T1078.004 - Valid Accounts: Cloud Accounts: POSSIBLE investigation hypothesis only. The sign-in captures do not establish adversary use of the account. (E-007/E-008)
• T1098.005 - Account Manipulation: Device Registration: POSSIBLE mapping if audit records establish an unauthorized MFA device registration. No such event has been established.

GeoJS requests are not sufficient to establish adversary reconnaissance or gating. Web requests, TLS failures, and redirects are not sufficient to establish command and control or exfiltration.

Technique definitions: MITRE Cloud Accounts, Device Registration, and JavaScript. These are interpretive references, not incident evidence.

Email findings

CONFIRMED observation: E-001 records authentication failures and a connecting IP. This supports review of sender authenticity; it does not establish account takeover. The original inbound EML is missing, so the complete message and attachment relationship cannot be independently verified from this package.

CONFIRMED in the investigation record: E-002 is a forward requested by the investigator and performed by Employee A for analysis. This classification is consistent throughout the report. Its approximate timestamp remains a separate verification task. The event is not evidence of attacker-initiated forwarding; other mailbox forwarding activity remains unassessed.

Authentication observation and competing explanations

E-007/E-008 show MFA previously satisfied by a claim. Legitimate session continuation or SSO can produce this result. Unauthorized session use is also a possible explanation, but the field alone does not distinguish the two. Microsoft documents acceptance of existing MFA claims during normal sign-ins. Microsoft MFA sign-in interpretation.

Required validation: Correlate full sign-in records with device identifiers, client/application details, IP context, session/correlation identifiers where available, authentication history, and the employee's account of activity. Review mailbox audit events for what the session accessed or changed. Until then, attacker token reuse and mailbox compromise remain unverified.

MFA configuration and policy coverage

Unauthorized MFA enrollment is a POSSIBLE hypothesis from the reported concern. DirectoryAudit records are needed to establish whether a method was added or changed, by whom, and whether it was authorized. A prior MFA claim does not establish a method change.

CONFIRMED observation: E-009 describes Security Defaults as disabled. Conditional Access may provide alternative controls, so disabled Security Defaults alone does not establish absent MFA or weak tenant security. Obtain the policy configuration and per-sign-in policy results. Microsoft Security Defaults and Conditional Access guidance.

• Content and code: Captured login impersonation, AES-GCM loader code, and clipboard restrictions support a phishing assessment. Credential-harvesting intent is LIKELY; actual data collection from Employee A is unverified. (E-017/E-026)
• Network associations: E-015 describes POST traffic involving geayioroo.sa.com; E-016 describes requests involving chouracea.sa.com. These are observed destinations. Collector roles remain POSSIBLE until request bodies, initiating code, and response behavior are validated. A POST request alone does not prove exfiltration.
• Cloudflare context: DNS answers, Ray IDs, and response captures support association with Cloudflare's edge. Shared edge IPs do not identify the origin server, prove common ownership, or justify blocking unrelated sites. Cloudflare's shared IP address documentation. (E-010/E-012/E-021/E-022)
• Transport observations: ECH indicators, redirects, 404 responses, connection resets, and the OpenSSL no-peer-certificate result are recorded conditions. Their causes are unresolved; none independently establishes malicious gating or evasion. (E-012/E-013/E-021/E-022)
• DNS and certificates: Split DNS, certificate names, and OCSP state support historical infrastructure mapping. Certificates and shared issuers do not establish malicious content, actor identity, or common control. (E-010/E-011/E-014/E-024/E-025)
• Vadreaje observations: Apex responses, Laravel-style cookie names, and sibling-host redirects/errors are documented. They do not establish that every host served a phishing page. (E-019/E-020/E-022)
• Branding and external pivots: Apps-house paths, a GANDALF logo, profile captures, historical pages, and the urlscan corpus are investigation leads. A shared logo or matching branding does not identify the operator. (E-017/E-018/E-023)
• Attribution: No person, group, or common operator is attributed. Shared kit code is a POSSIBLE explanation for similarities; copied assets and shared hosting are alternative explanations.

Established findings

The record documents phishing-related artifacts and infrastructure observations, email authentication failures, and two sign-in captures showing an existing MFA claim. It also documents a user-requested evidence transfer. These findings support further incident investigation, with the limits described in C5 and C6.

Unresolved impact

Credential submission, unauthorized mailbox access, attacker token reuse, MFA persistence, message/data exfiltration, financial loss, and lateral application access are not established. Their absence is not established either. The available evidence cannot support a final severity or recovery determination.

Investigation and response status

Investigation outcome: A documented evidence inventory and scoped set of findings and hypotheses, with follow-up collection and response recommendations. The record does not support claiming a completed containment or a resolved incident. This status reflects missing documentation, not a claim that no response occurred.

These are proposed follow-up actions. No completion is implied. Priorities in Appendix E guide investigation and response planning; they are not findings of confirmed compromise.

• Collect full Entra sign-in and DirectoryAudit records for 2025-08-25 through 2025-09-08 where retained. Test both legitimate and unauthorized-use explanations and determine whether authentication methods changed.
• Obtain the original inbound EML, verify the forwarded EML's timestamp, and validate the attachment and QR redirect chain in an isolated analysis environment.
• Review mailbox audit events, rules, forwarding, OAuth consents, and relevant application logs to assess access, persistence, and exposure. Preserve configurations before changing them.
• Assess session revocation, credential reset, and authentication-method review for the account based on the incident context. Document scope, administrator actions, and validation results; broaden response only when evidence supports it.
• Review Conditional Access configuration and per-sign-in results. Obtain other IdP/Okta logs only if those services are actually used by the client; impersonated branding alone does not establish deployment.
• Prepare targeted provider abuse reports where captured content or traffic supports a phishing allegation. Include the relevant hostname, URL, timestamp, and evidence. Track submissions and outcomes; certificate presence alone is insufficient evidence of abuse.
• Validate urlscan and DNS pivots before promoting them to malicious indicators. Treat shared CDN addresses, generic libraries, and branding as context.
• Establish business impact and a closure decision through account-owner confirmation, audit review, and post-response monitoring.

CONFIRMED: A narrowly stated observation or event supported by the existing investigation record. This does not extend to inferred intent, actor identity, or downstream impact. Original artifacts are not included in this package, so the revision is not an independent forensic verification.

LIKELY: An interpretation favored by the available evidence, with its basis and limitations stated. Login impersonation and loader context support likely credential-harvesting intent. Missing evidence by itself does not make a claim likely.

POSSIBLE: A plausible hypothesis that available evidence cannot distinguish from alternatives. Unauthorized session use, MFA changes, and collector roles are treated this way.

UNRESOLVED / NOT DOCUMENTED: The record is insufficient to determine an event, impact, or action status. These terms do not mean the event did not occur.

DISPROVEN: A claim contradicted by sufficient evidence. No current finding is assigned this status. Superseded interpretations in Appendix F are editorial corrections, not proof that all associated activity was benign.

Table interpretation: IOC confidence concerns the specific recorded value or association; it is not an automatic maliciousness verdict. Timeline confidence concerns the event described, with timing limits stated separately. Dataset counts show loaded rows, not forensic integrity.

The source report carries TLP: AMBER handling restrictions. This analytical revision retains that marking; redaction does not by itself change the source's distribution restrictions.

This is a case-study presentation of the investigation record. It does not claim law-enforcement submission, acceptance, endorsement, or evidentiary readiness. Original artifact validation and a complete chain-of-custody record are outside this package.

Version: v1.3. Original report date: 2025-09-08 (UTC). Editorial review: 2026-09-12.