The Mimecast Wrapper That Made a Phishing Link Look Safe

A targeted credential-phishing campaign impersonating a Dallas law firm used a one-day-old lookalike domain (crlaws.cam) hidden behind Mimecast SafeLinks rewriting and a fake “Powered by Microsoft Securely” badge to harvest credentials; the disposable domain went NXDOMAIN after use, SPF/DKIM/DMARC passed at the Mimecast relay while ARC preserved the upstream auth, and the report includes IOCs (domain, wrapped URL, relay IP, nameserver), analysis of the trust-chain manipulation, and actionable mitigations.