The Sign-In Link Pointed Home, and Home Was a Decoy

**OAuth-based spearphishing against a VIP:** A Teams-style email targeted a senior finance leader with a real Microsoft authorize request that contained a human-readable but fake 'uri' parameter pointing to a nonexistent internal subdomain; the request used prompt=none and lacked redirect_uri/response_type so the visible URL was a decoy and the true redirect would be controlled by the app registration. Actionable guidance: treat unknown client_id values as the primary indicator, search and block the client_id, and hunt Entra sign-in logs for related activity.