The Audit Request That Passed Every Authentication Check: How a Compromised Nonprofit Account Weaponized URL Shorteners

A compromised nonprofit Microsoft 365 email account was used to inject a qrco.de shortener URL into a legitimate audit thread to harvest credentials and facilitate BEC; authentication checks (SPF/DKIM/DMARC/ARC) passed because the message originated from the real infrastructure, but behavioral AI and community intelligence detected the shortener-based quishing evasion and quarantined affected mailboxes. Indicators (malicious short URL, sender email, header anomalies, DKIM selector) and mitigation guidance are provided.