Investigations have uncovered phishing campaigns using multi-stage redirection chains that abuse trusted cloud platforms and newly registered domains. One campaign abuses Framer, a no-code web platform, combined with Cloudflare Workers to host deceptive landing pages that utilize HTML redirection smuggling via the Blob API, Web Crypto API for decryption, and anti-debugging techniques to evade detection. Another campaign targets OneDrive credentials through device code phishing involving three-stage redirections with randomized alphanumeric newly registered domains. Both campaigns employ brand impersonation, custom CAPTCHA challenges, and anti-analysis techniques such as keyboard shortcut blocking. The threat actors leverage a hybrid infrastructure combining legitimate cloud services with short-lived domains to bypass traditional detection methods.

The campaigns aim to steal credentials, including OneDrive credentials, by deceiving users through complex redirection chains and evasion techniques. The use of trusted cloud infrastructure and short-lived domains complicates detection and mitigation by security tools. The anti-analysis and anti-debugging measures increase the difficulty of identifying and blocking these phishing attempts, potentially leading to successful credential theft and subsequent unauthorized access.

No official patches or fixes apply as this is a phishing campaign rather than a software vulnerability. Defenders should update email and web filtering rules to detect and block the identified domains and URLs associated with these campaigns. Awareness training for users about multi-stage phishing and brand impersonation tactics is recommended. Monitoring for the listed domains and URLs can help in early detection. Since the campaigns use short-lived domains and cloud services, continuous threat intelligence updates are essential. There is no vendor advisory indicating these threats are already mitigated or require no action.