Phishing Pages Delivered Through Refresh HTTP Response Header

Unit 42 observed widespread phishing campaigns (May–July 2024) that abused HTTP response header "Refresh" entries to automatically redirect recipients—often with their email address embedded—to tailored credential-harvesting pages impersonating webmail/login portals; the report includes detection statistics (thousands of malicious URLs and ~2,000 URLs/day at peak), sample URL chains, a CSV of 58 sanitized IOCs, targeted industry breakdowns, and mitigation recommendations including Palo Alto Networks Advanced URL Filtering.