Redirect-chain phishing defeats URL scanners in DocuSign lures

At a glance

What this is: This is a redirect-chain phishing campaign that hides a credential-harvesting page behind legitimate infrastructure and brand impersonation.

Why it matters: It matters because email security teams need to detect the full redirect path and brand mismatch, not just the first URL, to protect human identity and downstream access controls.

Context

Redirect-chain phishing is an email attack pattern where the visible link is only the first step, while the real payload sits behind one or more benign-looking hops. In this case, the sender used a DocuSign-style lure, a Google Maps redirect, and an Amazon S3-hosted login page to bypass scanner logic that only checked the first domain.

The governance gap is straightforward: many controls still trust the reputation of the first destination, the sending envelope, or the brand veneer rather than the full click path. That creates a blind spot for impersonation campaigns that blend legitimate infrastructure with credential theft, especially in environments where identity verification and email trust are treated as separate problems.

Key questions

Q: What breaks when email security only checks the first URL in a phishing message?

A: The control fails because the first URL can be benign while the final destination is malicious. Attackers use redirects to route users through trusted services, which lets the message pass reputation checks before the credential-harvesting page appears. Defenders need inspection that follows the chain end to end, not just the first hop.

Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?

A: They usually fail because identity is fragmented across systems. A domain may authenticate correctly in one layer while alignment breaks in another, especially when SaaS tools, agencies, and cloud services send mail on behalf of the business. The issue is usually ownership and lifecycle control, not the standards themselves.

Q: What are the signs that a brand impersonation email is hiding a credential theft flow?

A: Look for urgency, signature-request language, legal or invoice framing, mismatched sender infrastructure, and a login page hosted on unrelated cloud infrastructure. When those elements appear together, the brand is likely being used as a trust wrapper rather than a genuine communication channel.

Q: How should security teams respond when trusted services are used as redirect infrastructure in phishing?

A: Treat the redirect service as part of the attack path and score the final destination, not the reputation of the middle hop. Add correlation rules for unusual brand claims, cloud-hosted landing pages, and messages that combine legitimate services with credential prompts.

Technical breakdown

How redirect chains evade URL reputation checks

A redirect-chain attack separates the visible link from the final malicious destination. Security tools often score the first hop, then stop once they see a trusted domain such as a major search or maps service. By the time the browser resolves the next hop, the message has already cleared the filter. This is not a new evasion concept, but it remains effective because reputation systems are built for static URLs, not multi-step navigation. The final page can be hosted on broadly trusted cloud storage and still be malicious. Practical implication: inspect the full redirect path, not just the first domain, before deciding a message is safe. See the Phishing Guide.

Practical implication: Apply detonation or redirect-following inspection so the final destination, not the first hop, determines verdicts.

Why brand impersonation still bypasses user judgment

Brand impersonation works when visual familiarity and workflow urgency outrun scrutiny. A DocuSign-style prompt with legal-looking footers, a bank reference, and a Microsoft 365 login page creates enough context to lower suspicion, even when the infrastructure behind it does not belong to the claimed sender. This is an identity problem as much as a phishing one, because the attacker is borrowing the trust of a known brand to impersonate a legitimate communication. Practical implication: treat brand fidelity as a threat signal only when it aligns with infrastructure, domain ownership, and authentication evidence.

Practical implication: Correlate brand claims with sender identity, domain history, and authentication evidence before trusting the message.

Why email authentication can still pass on malicious mail

SPF, DKIM, and DMARC answer narrow questions about sending authority, signature presence, and policy handling. They do not prove that the message content is legitimate, that the brand being claimed matches the sender’s real business relationship, or that the landing page is safe. In this case, SPF passed because the envelope domain was authorized, DKIM was absent, and DMARC produced a best-guess pass. That combination can still deliver a malicious message into the inbox. Practical implication: use authentication as one input to risk scoring, not as a release condition on its own.

Practical implication: Require content and destination analysis in addition to SPF, DKIM, and DMARC before delivery decisions are made.

Threat narrative

Attacker objective: The attacker wanted to collect Microsoft 365 credentials from recipients who trusted the branded email and the benign-looking redirect chain.

1. Entry occurred through a DocuSign-themed email that used legitimate-looking law-firm branding and a forwarded-document format to induce a click.
2. Credential harvesting was staged behind a Google Maps redirect that led to an Amazon S3-hosted page mimicking a Microsoft 365 login.
3. Impact would have been credential theft and downstream account compromise if a recipient had entered credentials on the fake login page.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Redirect-chain phishing is a control-evasion pattern, not just a phishing variant. The attack works because each individual hop can look acceptable even when the sequence is hostile. That means defenders who judge risk at the first URL are measuring the wrong object. The control failure is not user awareness alone; it is the assumption that a safe-looking first hop equals a safe final destination. Practitioners should build policy around the end-to-end click path, not the first domain.

Brand impersonation becomes more effective when infrastructure trust and visual trust are evaluated separately. The message looked like DocuSign, the sender path looked legitimate enough to pass basic checks, and the landing page borrowed Microsoft branding. That split trust model is exactly why identity and email security teams need a shared view of sender claims, brand usage, and destination ownership. Phishing Guide is relevant here because brand impersonation remains one of the most durable delivery techniques in credential theft campaigns. Practitioners should correlate the claimed brand with the actual sender and destination before allowing user interaction.

Static reputation controls create a false sense of closure around delivery risk. SPF, DKIM, DMARC, and URL scanners all answered partial questions in this case, but none of them validated the whole abuse path. The operational lesson is that delivery controls must score message intent, not just message mechanics. Practitioners should assume that a passing authentication result can still coexist with credential theft if the payload is hosted behind trusted redirects.

Behavioral mismatch is the right analytical lens for modern email abuse. IRONSCALES flagged the inconsistency between the sender’s infrastructure and the claimed brand identity before the click, which is the kind of signal static reputation tools miss. That approach matters because the attacker’s real asset is not the domain alone, but the mismatch between what the message says it is and what the infrastructure proves it can be. Practitioners should prioritize detection logic that compares claimed identity, sender history, redirect behavior, and hosted content.

Credential-harvesting campaigns increasingly rely on trusted middle layers to launder malicious intent. Search, maps, storage, and collaboration services are often used as transit infrastructure because blocklists rarely treat them as universally hostile. That does not make those services the attacker’s subject; it means they are being abused as trust bridges. The governance implication is clear: security teams need controls that evaluate chained trust, not just isolated trust signals. Practitioners should treat the redirect chain itself as the indicator of compromise.

What this signals

Chain-aware inspection is becoming the minimum viable email control. The practical shift is from judging isolated links to evaluating how trust is composed across multiple hops. That matters for identity security because many phishing campaigns are really attempts to break the relationship between claimed identity and actual destination, and inbox controls need to measure that mismatch rather than the first safe-looking domain.

Phishing controls now need to treat brand impersonation as an identity event. When a message borrows DocuSign, Microsoft, legal stationery, and cloud hosting in one flow, the question is not just whether the email is malformed. The question is whether the communication identity is coherent from sender to payload, and that is a governance problem as much as a detection problem.

For practitioners

• Inspect full redirect chains before verdicting Follow every hop from the message link to the final destination, and score the landing page content as part of the email decision, not after delivery.
• Correlate brand claims with sender infrastructure Compare the claimed brand, sending domain, envelope path, and hosted destination for consistency whenever a message asks a user to sign or review content.
• Harden inbox policy against lookalike login pages Quarantine messages that combine identity-lure language, legal or invoice framing, and cloud-hosted login pages, even when the first-hop URL appears trusted.
• Treat authentication as one signal, not a clearance Use SPF, DKIM, and DMARC as inputs to phishing scoring, but never allow them to override destination analysis or content-based suspicion.

Key takeaways

• This campaign shows how phishing can remain effective even when each visible step appears legitimate, because the malicious intent is hidden in the sequence rather than the first link.
• The article’s evidence points to a control gap in first-hop URL scanning, brand impersonation detection, and the way email authentication is interpreted.
• Teams need chain-aware inspection, sender-content correlation, and destination analysis so a trusted redirect does not become a path to credential theft.

Related NHI Mgmt Group resources: Phishing Guide · API Key Management Guide · Secrets Management Guide · Ultimate Guide to NHIs: What are Non-Human Identities

Key terms

• Redirect-chain phishing: A phishing technique that hides the malicious destination behind one or more intermediary links or services. The first hop often looks legitimate, but the final page is designed to steal credentials or deliver malware after scanners and users have already trusted the early steps.
• Brand impersonation fraud: A fraud pattern in which attackers mimic trusted organisations to trigger urgent action, capture credentials, or collect payment data. The technical risk sits at the intersection of identity verification, channel assurance, and user trust, which is why security and fraud teams both own the response.
• Sender infrastructure mismatch: A discrepancy between the identity a message claims and the infrastructure that actually delivers or hosts it. This mismatch is a useful phishing signal because legitimate business communications usually show consistency across sending domain, hosted content, and user-facing brand.
• Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity for practitioners building stronger identity controls. It helps security teams connect identity governance to the broader access and trust decisions their programmes depend on.