Unchecked Redirection + URL Shortener = Spam

The report details how attackers exploit a poorly coded legitimate redirect page (example: fmcsa.dot.gov) to hide malicious final destinations behind URL shorteners, enabling spam/phishing redirects, and demonstrates an XSS vulnerability on the same redirect page that allows execution of arbitrary JavaScript and potential cookie theft.