Make-Shift Brand Impersonation: Abusing Trusted Domains with Open Redirects

KnowBe4 Threat Lab observed a phishing campaign (Oct 2–3, 2024) that abused open redirect (CWE-601) weaknesses in URL-rewriting/redirect services to obfuscate malicious destinations and borrow the reputation of legitimate domains, resulting in 173 reported emails primarily targeting U.S. finance and healthcare organizations; attackers delivered phishing pages via HTML attachments, PDFs with QR codes, manipulated legitimate URLs, hidden JavaScript, and fake Microsoft Teams notifications and the report provides technical details and defensive recommendations emphasizing human risk management, email filtering, MFA, patching, and training.