hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc

Posts referencing this indicator

• ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365

  Cisco Talos

  Attacker-controlled Microsoft 365 SharePoint tenant URL used as phishing destination; designed to look like legitimate vendor SharePoint while inheriting sharepoint.com's clean reputation

  2026-07-01