Fake Google 'Open to Edit' Alert Hides a Kajabi Redirect and Targeted Credential Harvest

**Phishing campaign using platform laundering:** A Google Docs-style spearphishing email was sent from a likely compromised UK healthcare domain (SPF/DMARC passing) and routed users through Kajabi email redirects that contained a base64-encoded recipient email in the URL fragment, enabling targeted credential harvesting; IOCs and detection recommendations are provided.