One Header Named the Attacker's Own Login

A targeted credential-harvesting phishing campaign impersonated recipients' own employer by abusing a compromised mailbox on a shared Korean business-mail platform; the platform's X-Authinfo header exposed the authenticating account (from a different company) and an Azure IP, explaining why SPF passed. The lure linked through an abused marketing-automation domain to a Microsoft OAuth authorize endpoint using prompt=none to silently probe for signed-in users (AADSTS50058 observed), indicating reconnaissance rather than immediate token theft; four senior legal/commercial mailboxes at a multinational firm were targeted and quarantined. Indicators include the X-Authinfo header, the OAuth URL and app ID, the marketing-relay domain, and template artefacts, and defenders are advised to hunt for X-Authinfo mismatches and alert on prompt=none in login.microsoftonline.com URLs.