Topic starter
25/10/2026 11:05 am
TL;DR: A DocuSign-themed credential-harvest slipped past URL scanners because the malicious page sat behind a redirect chain, IRONSCALES says. Scanner logic needs to follow the full path, or a trusted hop can hide the final credential theft page.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “The DocuSign Email That Wasn't - A Three-Redirect Credential Harvest”.
Key questions
Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?
A: They usually fail because identity is fragmented across systems.
Q: What are the signs that a brand impersonation email is hiding a credential theft flow?
A: Look for urgency, signature-request language, legal or invoice framing, mismatched sender infrastructure, and a login page hosted on unrelated cloud infrastructure.
Q: What breaks when email security only checks the first URL in a phishing message?
A: The control fails because the first URL can be benign while the final destination is malicious.
Practitioner guidance
- Inspect full redirect chains before verdicting Follow every hop from the message link to the final destination, and score the landing page content as part of the email decision, not after delivery.
- Correlate brand claims with sender infrastructure Compare the claimed brand, sending domain, envelope path, and hosted destination for consistency whenever a message asks a user to sign or review content.
- Harden inbox policy against lookalike login pages Quarantine messages that combine identity-lure language, legal or invoice framing, and cloud-hosted login pages, even when the first-hop URL appears trusted.
Bottom line: This campaign shows how phishing can remain effective even when each visible step appears legitimate, because the malicious intent is hidden in the sequence rather than the first link.
Glossary terms: Redirect-chain phishing, Brand impersonation fraud, Sender infrastructure mismatch, Credential Harvesting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Redirect-chain phishing is a control-evasion pattern, not just a phishing variant. The attack works because each individual hop can look acceptable even when the sequence is hostile. That means defenders who judge risk at the first URL are measuring the wrong object. The control failure is not user awareness alone; it is the assumption that a safe-looking first hop equals a safe final destination. Practitioners should build policy around the end-to-end click path, not the first domain.
A question worth separating out:
A: Treat the redirect service as part of the attack path and score the final destination, not the reputation of the middle hop. Add correlation rules for unusual brand claims, cloud-hosted landing pages, and messages that combine legitimate services with credential prompts.
👉 Read our full editorial: Redirect-chain phishing defeats URL scanners in DocuSign lures
This post was modified 7 days ago by NHI Mgmt Group