Redirect Laundering: How Attackers Weaponize Trusted Infrastructure to Bypass Email Security

This report documents two high-confidence phishing campaigns that leveraged "redirect laundering"—routing malicious links through trusted security and academic/cloud infrastructure (SafeLinks, Cisco Secure Web, an AAF portal, and Amazon S3) to obscure final credential-harvesting pages—providing redirect chains, IOCs, and analysis showing static URL reputation checks can be bypassed and recommending chain-aware, behavior-based defenses.