Phishers Weaponize Safe Links With Multi-Layered URL Rewriting to Evade Detection

Phishing attackers have found a way to turn a standard security feature against the very users it was built to protect.

By abusing URL rewriting — a defensive mechanism embedded in most enterprise email gateways — threat actors are weaponizing trusted safe links to carry malicious payloads past detection filters.

What was once a reliable protective layer has quietly become a tool of deception.​

URL rewriting works by intercepting links inside incoming emails and replacing them with vendor-generated URLs that route users through security scanning servers the moment a link is clicked.

Threat actors exploit this by operating through compromised accounts where URL rewriting is active, tricking the system into generating pre-wrapped safe links that carry a trusted vendor domain and can be reused across broad phishing campaigns.​

LevelBlue analysts identified a significant escalation in this tactic between the second and fourth quarters of 2025, noting that adversaries had moved from single-layer abuse to building multi-layered URL rewriting chains across several trusted vendor domains.

The goal was to stack redirect hops deep enough that no automated scanner could trace the link back to its true destination.

This activity was observed across phishing-as-a-service platforms, specifically Tycoon2FA and Sneaky2FA, both targeting Microsoft 365 users.​

Both platforms use adversary-in-the-middle architecture to intercept credentials and multi-factor authentication session cookies in real time, enabling account takeover without the victim’s knowledge.

Once inside a compromised environment, attackers manipulate mailbox rules, launch internal phishing campaigns, exfiltrate sensitive data, and in serious cases, deploy ransomware.

Activity data confirms campaigns using three or more URL rewriting services began in mid-2025 and peaked in January 2026, signaling an aggressive push toward deeper redirect chains.​

As of early 2026, these campaigns remain active. Their integration into established phishing-as-a-service ecosystems signals a threat that is deliberately built to stay hidden behind the security tools organizations trust most.​

Multi-Layered Redirect Chains in Action

The Tycoon2FA campaign illustrates how this attack unfolds in practice. Victims received a document request-themed email impersonating Microsoft, containing a URL over 1,200 characters long.

When clicked, the link passed through five consecutive vendor layers — Libraesva, Sophos, Inky, EdgePilot, and Barracuda — before landing on a compromised website.

That site served a CAPTCHA challenge to filter automated tools, after which victims were shown a fake Microsoft sign-in page designed to steal credentials.

The Sneaky2FA campaign targeted a law firm using an HTML attachment instead of an embedded hyperlink.

Inside the file, the phishing URL was stored in a variable named REDIRECT_URL, pre-built with a rewriting sequence through Barracuda, Sophos, and Cisco.

After routing through a legitimate marketing automation platform, the chain resolved to a newly registered domain impersonating the law firm, with the victim’s email address already pre-filled in a fraudulent Microsoft login screen.​

Every hop in both chains used a domain from a recognized security vendor, meaning automated scanners encountered only trusted names and routinely stopped before following the full path — exactly what these attackers relied on.​

Organizations should adopt phishing-resistant MFA methods such as hardware security keys to reduce session cookie theft even when credentials are exposed.

Security teams should deploy behavioral detection controls that flag emails containing URLs chaining through multiple rewriting services.

Employees must be trained to question any unexpected authentication prompt, regardless of how familiar the surrounding domain appears.

Awareness programs should reinforce that a vendor-branded URL is not a guarantee of a safe destination. All suspicious emails should be reported to the security team without delay.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.