Attackers Leveraging XSS To Make Phishing Emails Increasingly Evasive

Attackers are shifting phishing campaigns toward link-based lures and using techniques such as reflected XSS and URL redirection to bypass email security filters; Vipre's Q1 2024 analysis found 75% of phishing emails used links (24% used attachments, 1% QR codes), with redirection and compromised legitimate URLs enabling bait-and-switch behavior that evades detection.