Loading story…
Mandiant reported that threat actors are using URL schema abuse to disguise malicious destinations and make phishing or malware-delivery links appear less suspicious to users and security tools. The technique manipulates how URLs are parsed and displayed, allowing attackers to hide the true destination behind crafted schemes and obfuscated formatting that can evade casual inspection and some automated detections.
The report highlights URL obfuscation as a practical social-engineering and defense-evasion method that can increase click-through rates and complicate incident response. For defenders, the findings underscore the need to normalize and fully parse URLs during inspection, validate scheme handling in security controls, and train users to treat unusual or malformed links as potentially malicious even when the visible text appears benign.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published a blog post detailing URL obfuscation techniques that abuse URI schemas, describing the tactic as a security-relevant finding. No earlier discrete real-world events are provided in the reference content.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
A phishing URL was crafted to exploit inconsistent URL parsing across browsers, validators, extractors, and security controls. The link places an RFC 3986 `userinfo` component before the first `@`, uses an unusual hostname label ending in a hyphen, and embeds the intended recipient’s email address in the path, creating misleading indicators that can confuse automated inspection and users. Although portions of the URL can be interpreted as email addresses or as a reference to the trusted `isc.sans.edu` domain by flawed tooling, the browser’s effective destination is an attacker-controlled lookalike domain. Security teams should ensure email gateways, URL scanners, logging pipelines, and user-facing link previews consistently apply modern URL parsing rules and identify the effective host after userinfo delimiters rather than relying on string matching or permissive extraction logic.
Sep 24, 2026
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026