Nespresso Domain Serves Up Steamy Cup of Phish, No Cream or Sugar

A phishing campaign is exploiting an open-redirect vulnerability on Nespresso's legitimate website to deliver a malicious HTML page mimicking a Microsoft login and harvest credentials via spoofed Bank of America emails; attackers rely on the trusted domain to evade security tools that inspect only initial links, and researchers reported the redirect remained unpatched.