Cybercriminals Exploit Link Wrapping Features of Proofpoint and Intermedia to Conceal Phishing Attacks

Cloudflare Email Security reported a June–July 2025 phishing campaign that leverages legitimate link-wrapping services (Proofpoint and Intermedia) and URL shorteners to obfuscate malicious links and redirect victims to credential-harvesting pages impersonating Microsoft; researchers observed multi-tier redirect chains and recommend behavioral analysis, ML detection rules, and user training to mitigate the threat.