Loading story…
Unit 42 observed large-scale phishing campaigns using HTTP Refresh response headers to redirect browsers to credential-stealing pages, detecting approximately 2,000 associated malicious URLs daily from May through July 2024. Attackers primarily distributed links through email, using legitimate or compromised domains, URL-shortening services, and intermediate redirects to conceal phishing destinations. Redirect URLs embedded recipients’ email addresses, enabling personalized webmail login pages with pre-filled account details.
Targets spanned global businesses, financial institutions, government agencies, educational institutions, and users of major internet portals; a June campaign predominantly targeted large corporations in Korea. Some counterfeit Outlook login pages captured up to three password submissions before redirecting victims to the legitimate Office website. The technique highlights the need for email and web defenses to inspect HTTP-header redirects and complete redirect chains, rather than relying solely on the initial link’s domain or page content.
Get the infrastructure and lures behind it.
10 events from the most recent confirmed update back to the earliest known activity.
On July 14, 2024, Unit 42 observed a phishing page using an original URL under impactchd[.]in that redirected through an HTTP Refresh header to hk6.8ik8rq[.]ru. The chain embedded a Base64-encoded recipient email address in the original URL and the recipient's email address in the final URL fragment.
A campaign using guide-orientation[.]tn initial URLs emerged in late June and peaked on July 2, 2024. It generated 1,888 detections and primarily targeted the business-and-economy sector.
On June 20–21, 2024, Unit 42 observed large-scale email phishing campaigns predominantly targeting large corporations in Korea, alongside campaigns targeting U.S. government agencies and schools. One June campaign spoofed DocuSign-related senders and used recipient-specific header-refresh URLs to deliver domain-tailored credential phishing pages.
A campaign using speedpython[.]com initial URLs peaked on May 14, 2024, and primarily targeted government. Unit 42 recorded 3,027 detections associated with the campaign.
A campaign using onelink[.]me initial URLs peaked on May 10, 2024, and generated 5,537 detections. The approximately month-long campaign primarily targeted financial services and reached more than 3,000 people across more than 500 organizations.
A campaign using go[.]link initial URLs peaked on May 6, 2024, and primarily targeted the news industry. Unit 42 recorded 5,374 detections associated with the campaign.
On May 5 and May 21, 2024, Unit 42 observed redirects from cices[.]org through dominicanmidia[.]com to a fake Outlook page at sirius-maritime[.]com/0utl0ok/. The page pre-filled a targeted technology-company user's email address, captured up to three password submissions, and then redirected the victim to office[.]com.
From May through July 2024, Unit 42 detected approximately 2,000 malicious URLs per day associated with campaigns using HTTP Refresh response headers. Attackers predominantly distributed links through phishing emails and redirected recipients to personalized credential-stealing pages.
A campaign using club-os[.]com initial URLs peaked on April 12, 2024, primarily targeting business-and-economy organizations in Japan. Unit 42 recorded 2,384 detections associated with the campaign.
Palo Alto Networks shared its findings with Cyber Threat Alliance members. Unit 42's research identified suspicious Refresh headers containing email addresses and extracted URL patterns to find additional phishing websites, with no legitimate sites found exhibiting the same phishing-specific behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly using **HTML attachments** in phishing emails to evade detection and steal credentials, embedding malicious logic directly in attached files instead of placing suspicious links in the message body. The attachments commonly use JavaScript to redirect victims to fraudulent login pages or to display a complete phishing page locally inside the browser, making the email appear less obviously malicious to both users and some security controls. Researchers found that attackers also obfuscate these attachments to hinder static analysis, including hiding phishing URLs, concealing entire scripts, and using deprecated JavaScript functions such as `unescape()` to decode and render phishing content at runtime. Kaspersky reported detecting nearly **2 million** emails carrying malicious HTML attachments in the first four months of 2022, including **851,328** blocked in March alone, underscoring how effective and persistent the technique remains for credential-harvesting campaigns.
Aug 15, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026