The Grant Thread Was Real. The Portal Was Not.

A compromised nonprofit Google Workspace mailbox was used to append a malicious Dynamics 365 marketing redirect link to an otherwise genuine federal grant notification and send it to an unrelated recipient, constituting a thread-hijack phishing lure likely intended for credential harvesting; static URL reputation appeared clean, authentication showed spf=none, dkim passed but was unaligned, and dmarc failed with p=none, so detection relied on behavioral signals (first-time sender, undisclosed recipients vs. quoted thread, and mismatched recipient history).