Mind your header! There's nothing refreshing about phishers' latest tactic

Unit 42 observed an increasing phishing trend where attackers embed malicious URLs in HTTP Refresh response headers to automatically redirect victims—often via legitimate or compromised domains—to spoofed login pages that harvest credentials; roughly 2,000 large-scale campaigns were detected between May and July, with business and financial sectors heavily targeted.