Open Redirect Chains Still Enable Credential Theft at Scale
Defenders can limit impact by tightening redirect governance and expanding URL detonation context in triage.
By PhishPond Desk
Trend Snapshot
Despite years of awareness, open redirects remain embedded in phishing delivery chains. Campaign operators leverage trusted brand domains as initial click points, then hand off users to credential collection pages through multiple redirect hops.
Why Defenders Care
Blue teams that inspect complete URL chains observed more consistent detection outcomes than those evaluating only first-hop domains. Redirect-aware telemetry also improved retrospective hunt quality.
Adversary Playbook
Application security teams play a direct role in phishing resilience by reducing exploitable redirect endpoints. Shared ownership between AppSec and SOC functions lowered campaign success in organizations that treated redirect abuse as a defensive priority.
Defender Takeaway
Audit and remediate open redirects as part of phishing defense, and enrich triage with full redirect-chain context.
Get the weekly phishing tradecraft brief
One concise email with new campaign notes, detection ideas, and project radar worth a defender's time.
No spam. Unsubscribe anytime. Subscriber details are used only for this publication.
AvisLoader shows why taking down a lure does not establish that a compromised endpoint has lost its control channel. Examine Tox-based communications, ToxNetV2 as a separate Radar companion, and assessment objectives for detection, privacy, and containment.
Microsoft's DCU disrupted EvilTokens on September 22, 2026 — a $1,500 device-code phishing platform tied to 12,000 compromised inboxes across 10,000 organisations. The operator is gone. The flow it abused is unchanged, and the serverless infrastructure pattern is the part that outlives the brand.
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.