When Your Security Vendor's OAuth Endpoint Is the Phishing Link

A targeted credential-harvesting phishing campaign impersonated Pandora and embedded a CTA pointing to Mimecast's legitimate OAuth2 authorization endpoint with a redirect_uri that landed on an attacker-controlled callback; because the link resolved to api.services.mimecast.com and authentication (SPF/DMARC) passed, reputation-based scanners rated it clean. The report outlines the delivery chain (Amazon SES → Mimecast relay → Exchange Online), explains how Mimecast's body rewriting caused DKIM body-hash failures that masked risk signals, and recommends behavioral detection (e.g., flagging OAuth authorize URLs in transactional emails and parsing redirect_uri parameters) alongside specific IOCs (sending domain calclean.com, sender [email protected], IP 54.240.9.30, and the OAuth/redirect URLs).