A sophisticated Phishing campaign is currently targeting marketing professionals by exploiting the prestige of major global brands. According to Dark Reading, attackers are leveraging fraudulent job offers for companies like Netflix, Disney, and Amazon to lure victims into a credential theft trap designed specifically to compromise Google accounts.
Technical Analysis: Nested Redirects and Evasion
The primary technical innovation in this campaign is the use of nested redirects. Unlike traditional phishing links that point directly to a malicious landing page, these attackers use a series of intermediate URLs—often hosted on legitimate but compromised websites or cloud services—to mask the final destination. This TTP is highly effective at bypassing automated email security filters that may only scan the first or second hop of a link.
By the time a security engine processes the URL, the chain of redirects may have changed, or the final malicious payload might only be served if specific browser headers are present. This behavior maps closely to MITRE ATT&CK techniques related to Spearphishing Link (T1566.002) and Web Service (T1102). Once the victim navigates the redirect chain, they are presented with a highly convincing fake Google login portal. This portal is designed to capture not only passwords but also session tokens, potentially bypassing basic two-factor authentication if the user is prompted to approve a push notification or enter a code on the fraudulent site.
How to Detect Phishing Campaigns Using Nested Redirects
For a SOC analyst, detection requires looking beyond the initial URL. Security teams should monitor for high-frequency redirects originating from email clients. Analysis of network traffic logs might reveal a pattern where a single click leads to three or more disparate domains within seconds. Implementing advanced EDR solutions that can inspect browser memory or process execution following a web navigation event is essential for identifying these multi-stage attacks.
Furthermore, integrating threat intelligence feeds into a SIEM can help flag known redirector domains. Because these campaigns often target marketing professionals who frequently interact with external vendors and recruitment platforms, the baseline for ‘normal’ behavior is often noisier, making fine-tuned detection logic necessary.
Impact on Identity and Access Management
The theft of Google credentials represents a significant risk for Lateral Movement. In many modern enterprises, Google Workspace serves as the primary Identity Provider (IdP). A compromised Google account can grant an attacker access to shared drives, internal communications via Slack or Teams, and sensitive marketing data including customer lists and campaign strategies.
Google Account Hijacking Mitigation Steps
To defend against this specific threat, organizations must move beyond simple password-based security. Implementing Zero Trust principles is a highly effective strategy. This includes requiring hardware-based security keys (FIDO2) which are resistant to phishing because they bind the authentication session to the legitimate domain. Even if a user is tricked by a nested redirect into visiting a fake site, the hardware key will refuse to provide the necessary cryptographic material because the URL does not match the expected service.
Recommendations for Defenders
- User Awareness Training: Educate staff, particularly in HR and marketing, about the risks of recruitment-themed phishing. Emphasize that legitimate recruiters from major brands will typically communicate through official corporate domains or verified LinkedIn profiles.
- URL Sandboxing: Deploy email security gateways that perform deep-link analysis and ‘time-of-click’ protection, which follows redirect chains to their final destination before allowing the user to proceed.
- Session Management: Reduce the lifespan of active sessions and implement risk-based authentication that triggers additional verification steps when a login attempt occurs from an unrecognized device or IP range.
Related: Job Interview Phishing Targets Google Accounts of Marketing Professionals, North Korean APT Targets Developers via Malicious Tooling