The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains

This report documents multiple sophisticated phishing campaigns that leverage trusted cloud platforms and newly registered domains to implement multi-stage redirection and device-code phishing (impersonating Google/OneDrive). Techniques include HTML redirection smuggling (Blob API), client-side decryption (Web Crypto API), anti-debugging controls, and CAPTCHA gating; specific IOCs are provided and VirusTotal scans showed detection only by LevelBlue.