outlookowaappdropsmessagesharespacefolderfilesharngfolderl[.]bubbleapps[.]io

This domain is flagged for brand impersonation targeting Microsoft users through a credential harvesting scheme. The infrastructure mimics legitimate Microsoft login portals, specifically Outlook and OneDrive services, to deceive users into entering account credentials. Analysis indicates the domain was designed to capture authentication tokens or session cookies, potentially leading to unauthorized account access or data exfiltration. Evidence supporting this assessment includes detection by 17 out of 95 security vendors on VirusTotal, registration through Cloudflare, Inc. on February 21, 2026, and resolution to a Cloudflare-hosted IP address (104.18.245.24). The domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1). Infrastructure analysis reveals the use of Cloudflare’s AS13335, a common tactic to obscure hosting origins and evade detection. Users who visited this domain should immediately revoke any active sessions associated with Microsoft accounts, reset passwords using multi-factor authentication, and review account activity for unauthorized access. System scans for malware are recommended, as credential harvesters may deploy secondary payloads. Organizations should add the domain and associated indicators (IP, SSL issuer) to blocklists to prevent further exposure. Monitoring for unusual login attempts or data access patterns is advised.