Overview

This report highlights a rise in phishing activity involving domains that imitate Microsoft SharePoint through structured naming patterns. One identified case features a spoofed login page consistent with Sneaky2FA techniques. Additionally, increased abuse of the legitimate hosting platform Alboompro has been observed for hosting phishing content.

Summary

Recent activity shows an increase in domains masquerading as Microsoft SharePoint. These domains follow consistent structural patterns and are generated using persistent techniques. Since June 26, both the number of these domains and the volume of related tasks in which they appear have risen noticeably.

The chart shows the dynamics of such domain appearances from June 26 to July 9, 2025 (UTC+0).

phishsharepoint

Examples of Observed Domains

  • 9yusq7ngwdm365cj87v39gs5do8we-mysharepoint.tahofire[.]org

  • 2yusq7ngwdm835cj87v63gs5do8we-mysharepoint.fencecorps[.]org

  • 9yusq7ngwdm365cj87v39gs5do8we-mysharepoint.wsrevices[.]org

  • 3yusq7ngwdm835cj87v63gs5do8we-mysharepoint.twfasc[.]org

  • 5yusq7ngwdm835cj87v63gs5do8we-mysharepoint.laborers551[.]org

  • 2yusq7ngwdm385cj87v68gs5do8we-mysharepoint.capernos[.]org

  • 2yusq7ngwdm385cj87v68gs5do8we-mysharepoint.gafestivaloftree[.]org

All listed domains share recurring structural patterns, which can be leveraged to track and proactively detect similar malicious activity.

All use the .org top-level domain. The majority of second-level names are structured to mimic legitimate resources associated with U.S.-based organizations, such as:

  • tahofire — tahoelivingwithfire.com (USA)

  • fencecorps — fencecorp.us (USA)

  • laborers551 — laborers155.org (USA)

  • capernos — caprenos.com (USA)

The portion of the third-level domain preceding -mysharepoint consists of a 29-character string that follows a consistent structure:

9yusq7ngwdm365cj87v39gs5do8we

2yusq7ngwdm835cj87v63gs5do8we

9yusq7ngwdm365cj87v39gs5do8we

3yusq7ngwdm835cj87v63gs5do8we

5yusq7ngwdm835cj87v63gs5do8we

2yusq7ngwdm385cj87v68gs5do8we

2yusq7ngwdm385cj87v68gs5do8we

In these third-level components, only the numeric characters vary in certain positions, while the rest of the string remains constant. The -mysharepoint segment is a fixed part of the third-level domain and appears consistently across all observed samples.

Threat Hunting via TI Lookup

A TI Lookup query can be created to search strictly by using this fixed pattern:

domainName:"?yusq7ngwdm??5cj87v??gs5do8we-mysharepoint.*.org"

It is also possible to simplify the query to cover cases when the portion preceding -mysharepoint.*.org varies, while preserving the overall structure:

domainName:"*-mysharepoint.*.org"

With the following TI Lookup query, we can search through recent public sandbox analyses.

TI Lookup: domainName:"*-mysharepoint.*.org"

Using this query in ANY.RUN’s TI Lookup makes it possible to identify all analysis sessions associated with similar domains.

As a result, more than 40 matching sessions were found.

The earliest recorded activity dates back to June 26, 2025.

Let’s take a closer look at one of the earliest tasks.

Analysis of a Typical Phishing Case

  • Analysis: ANY.RUN

Analysis session contains a phishing email that impersonates a legitimate company and includes a malicious link.

Its body contains a link that appears to lead to a document but actually points to the subdomain midwesthose-specialty[.]alboompro.com, hosted on the legitimate platform alboompro.com.

Alboompro.com is a service for creating online portfolios and landing pages, where users are free to choose their own subdomains.

Threat actors exploit this feature by registering subdomains that mimic legitimate websites. In this case, the domain midwesthose-specialty[.]alboompro.com was created to impersonate the legitimate U.S.-based company midwesthose.com.

After following the link in the email, the victim is prompted to open a PDF document. It is stated that the file is protected, and access requires using the same email address to which the message was originally sent.

fakepdf

Clicking the “View Document” button redirects users to 2yusq7ngwdm385cj87v68gs5do8we-mysharepoint.capernos[.]org where they are required to complete a CAPTCHA challenge.

captcha

After completing the CAPTCHA, a phishing page opens, designed to harvest Microsoft credentials by mimicking the legitimate login interface.

fakelogin

We classify this threat as Sneaky2FA.

The victim sees the legitimate Microsoft login interface, as the content is loaded directly from the official website — but through an attacker-controlled proxy server.

snaky2fa

This is a typical scenario for Sneaky2FA: the victim interacts with the legitimate-looking login page, while the attacker intercepts the credentials being entered.

Infrastructure Abuse

It is also worth noting the active use of the Alboompro.com service by threat actors. Since May, more than 250 tasks involving the domain alboompro.com have been identified. In addition, over 130 subdomains containing alboompro.com have been recorded. Many of them exhibit indicators of malicious activity, confirming the ongoing and widespread use of this platform in phishing campaigns.

With the following TI Lookup query, we can search through recent public sandbox analyses.

TI Lookup: domainName:"*.alboompro.com"

Conclusion

Our research indicates a growing number of domains mimicking SharePoint through consistent patterns, alongside increased abuse of Alboompro to host phishing content. These trends underscore the need for continuous monitoring of domain structures and legitimate service misuse.