Wanted

ShaгеPoint Cloud

Rogue MRA-2019-0001

2 letters in this name are Cyrillic, so it can pass as a name you'd trust.

What's known

Application ID: 0bd8e698-4298-405a-bc6b-da5647a4616b
Owner tenant ID: a4afdac5-f28f-4161-87c4-b5f7625bc048
Found: 2019, 7 years ago. The year the source last saw it, and the only date on record.
Reply URLs (defanged): hxxps://achilleshosting[.]website
hxxps://achilleshosting[.]website/login
hxxps://microzoftonline[.]com
hxxps://sharepoint[.]microzoftonline[.]com
hxxps://sharepoint[.]microzoftonline[.]com/index[.]php
hxxps://www[.]office[.]com/apps?auth=2

Where this comes from

Named in Wiz's research into malicious Azure OAuth applications. Read the source. Checked 9 November 2026.
Listed in Cyera's published malicious Microsoft 365 app indicators. Read the source. Checked 9 November 2026.

If it's in your tenant

These commands find it, show which permissions it was granted, then disable it. Disabling keeps the app and its audit trail for your investigation, so remove it afterwards. Then review what it accessed and revoke the sessions of anyone who consented.

Connect-MgGraph -Scopes "Application.ReadWrite.All"
$sp = Get-MgServicePrincipal -Filter "appId eq '0bd8e698-4298-405a-bc6b-da5647a4616b'"
$sp | Format-List DisplayName, Id, AppId, AccountEnabled
Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false