One Code, Five Places, One Unsubscribe Open Redirect

A targeted phishing campaign delivered clean PDF attachments that abused a legitimate email marketing platform's unsubscribe endpoint as an open redirect to a credential-harvesting site; each recipient received a unique per-recipient code embedded across the sender display name, subject and redirect URL (including a fragment containing the victim's mailbox in base64). Three mailboxes at a multinational metals-and-mining organisation were targeted on 11 December 2025, delivery passed SPF/DKIM/DMARC because an authenticated account was used, and human review quarantined the messages.