Two Brands in One Message, One URL Built at Runtime

An unauthenticated spearphishing email sent to a shared remittance mailbox contained a 16,462-byte HTML attachment that rendered a fake Microsoft SharePoint access page demanding a work address; the attachment built a credential-harvesting redirect at submit time by concatenating a nested chain using Google redirect endpoints and encoding the recipient address in a base64 fragment. The send originated from IP 45.133.174.12 with SPF fail/DKIM absent/DMARC none, the attachment scanned clean, and IoCs include the attachment filename and hash plus the terminal domain radio11.org; no confirmed successful credential capture was recorded.