Three Hops, Two Brands, One Fake WAV File: Inside a Multi-Layer Redirect Phishing Attack

This report analyzes a high-confidence spearphishing campaign that delivered a voicemail-themed credential-harvesting lure to a regional bank by chaining redirects through Microsoft SafeLinks and Cisco Secure Web to a malicious destination (ithm.org), leveraging brand-mixing and homoglyphs to evade detection; two targeted mailboxes were quarantined before interaction and the report provides IOCs and defensive recommendations to detect multi-hop URL evasion and treat authentication passes as one signal among many.