Loading story…
A phishing URL was crafted to exploit inconsistent URL parsing across browsers, validators, extractors, and security controls. The link places an RFC 3986 userinfo component before the first @, uses an unusual hostname label ending in a hyphen, and embeds the intended recipient’s email address in the path, creating misleading indicators that can confuse automated inspection and users.
Although portions of the URL can be interpreted as email addresses or as a reference to the trusted isc.sans.edu domain by flawed tooling, the browser’s effective destination is an attacker-controlled lookalike domain. Security teams should ensure email gateways, URL scanners, logging pipelines, and user-facing link previews consistently apply modern URL parsing rules and identify the effective host after userinfo delimiters rather than relying on string matching or permissive extraction logic.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A phishing email used the URL hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu to exploit inconsistent URL parsing. A conforming browser would connect to the attacker-controlled gynd--.koncar-hr.com host, while flawed tooling could misidentify the destination as isc.sans.edu or fail to process the unusual hostname.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourceurl.spec.whatwg.org
Open sourcerfc-editor.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that threat actors are using **URL schema abuse** to disguise malicious destinations and make phishing or malware-delivery links appear less suspicious to users and security tools. The technique manipulates how URLs are parsed and displayed, allowing attackers to hide the true destination behind crafted schemes and obfuscated formatting that can evade casual inspection and some automated detections. The report highlights URL obfuscation as a practical social-engineering and defense-evasion method that can increase click-through rates and complicate incident response. For defenders, the findings underscore the need to normalize and fully parse URLs during inspection, validate scheme handling in security controls, and train users to treat unusual or malformed links as potentially malicious even when the visible text appears benign.
Jul 12, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Threat actors are abusing the special-use **`.arpa`** DNS namespace—intended for internet infrastructure and reverse-DNS lookups—to make phishing infrastructure harder for email security gateways and reputation systems to evaluate. The activity leverages reverse-DNS conventions (IPv4 `in-addr.arpa` and IPv6 `ip6.arpa`) but uses **atypical forward-lookups** (e.g., `A`/`AAAA` records) and non-standard hostnames under `.arpa`, which can slip past controls that treat `.arpa` traffic as benign or “internal plumbing.” Reporting attributed the technique to observations shared by **Infoblox**, noting it combines legacy DNS assumptions with modern **IPv6** usage to reduce detection efficacy for “basic scam-type” phishing, with concern it may be applicable to more targeted operations. Defensive guidance highlighted that legitimate `in-addr.arpa` names follow a strict IP-derived format ending in the suffix, so **any `.arpa` query that is not a PTR-style reverse lookup or does not match expected naming patterns** should be blocked or at least alerted on, and organizations should review DNS/email filtering logic to ensure `.arpa` is not implicitly trusted.
Jun 29, 2026