Redirect-chain phishing: what practitioners need to act on

TL;DR: Attackers used a DocuSign-themed email that routed through Google Maps to an Amazon S3 credential-harvesting page, defeating URL scanners that stopped at the first hop, according to IRONSCALES. Static checks miss chained redirects, and behavioral mismatch detection is now a more reliable signal than link reputation alone.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “The DocuSign Email That Wasn't - A Three-Redirect Credential Harvest”.

Key questions

Q: What breaks when email security only checks the first URL in a phishing message?

A: The control fails because the first URL can be benign while the final destination is malicious.

Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?

A: They usually fail because identity is fragmented across systems.

Q: What are the signs that a brand impersonation email is hiding a credential theft flow?

A: Look for urgency, signature-request language, legal or invoice framing, mismatched sender infrastructure, and a login page hosted on unrelated cloud infrastructure.

Practitioner guidance

• Inspect full redirect chains before verdicting Follow every hop from the message link to the final destination, and score the landing page content as part of the email decision, not after delivery.
• Correlate brand claims with sender infrastructure Compare the claimed brand, sending domain, envelope path, and hosted destination for consistency whenever a message asks a user to sign or review content.
• Harden inbox policy against lookalike login pages Quarantine messages that combine identity-lure language, legal or invoice framing, and cloud-hosted login pages, even when the first-hop URL appears trusted.

Bottom line: This campaign shows how phishing can remain effective even when each visible step appears legitimate, because the malicious intent is hidden in the sequence rather than the first link.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →