T1566.002 Phishing: Spearphishing Link
2 threats tracked by Spectrum Delta use this technique.
Wazza device-code phishkit
Spearphishing link: campaign routing and anti-automation filtering
Proxy telemetry with URL/content visibility: the redirect chain across Google Sites, .eu/.com domains and Cloudflare Workers; requests to /api/wazza-config, /api/mint-token and the protection endpoints; long randomized workers[.]dev subdomains; decoy-site paths; the two-second status polling from the final page. DNS provides domain-level corroboration only; the anti-automation checks are code-analysis findings — their execution is established only with browser/script instrumentation
Device-code phishing as document verification
Entra sign-in logs: device-code flow authentications for accounts that shortly before clicked through the lure chain — evidence of the flow, not proof of phishing or compromise; web proxy: the victim reaching Microsoft's device-authentication endpoint. The primary provides no Entra event IDs, error codes or application IDs; consent changes are not sign-in-log events and are not claimed
Seen in: Web proxy / DNS, Entra sign-in logs
GCP billing LLMjacking
Spearphishing via search ad with credential and MFA capture
Google Workspace User Log Events: suspicious login flags and anomalous re-authentication triggers (the primary's stated early-detection signal); web proxy/DNS telemetry for the 17 phishing domains as corroborating access evidence
Seen in: Google Workspace User Log Events