Inside Multi-Stage Phishing Redirection Chains

Recent investigations have uncovered sophisticated phishing campaigns employing multi-stage redirection chains that abuse trusted cloud infrastructure and newly registered domains. One campaign exploits Framer, a no-code web platform, combined with Cloudflare Workers to host deceptive landing pages. These pages utilize HTML redirection smuggling via the Blob API, Web Crypto API for decryption, and anti-debugging techniques to evade detection. Another campaign involves device code phishing targeting OneDrive credentials through three-stage redirections using newly registered domains with randomized alphanumeric strings. Both campaigns employ brand impersonation, custom CAPTCHA challenges, and anti-analysis measures including keyboard shortcut blocking. The threat actors leverage a hybrid infrastructure combining legitimate cloud services with short-lived domains to bypass traditional detection methods.

• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• Crafty Microsoft Teams Booking Flow Disguises Device Code PhishingCampaign2026-11-12
• The Industry Leader in Enterprise Brand ProtectionPhishing2026-11-09
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05
• ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationHighVulnerability2026-11-05