Known Sender, Perfect Auth, Confirmed Malicious Link

A legitimately authenticated CRM reply from a vendor to a healthcare logistics coordinator contained a malicious hyperlink (https://process.to/) that was scored malicious by multiple scanners and a sandbox (66/100); the message was quarantined on three delivery attempts and three known-sender release requests were denied. The report documents IOCs (URL, domain, sending IP, auth results), maps the attack to MITRE T1566.002 and T1204.001, and recommends treating authentication as an identity control while enforcing verdict-level URL/payload re-evaluation in release workflows to prevent human-driven release errors.