Topic starter
12/06/2026 12:16 am
TL;DR: A phishing campaign used legitimate Microsoft login redirects, ADFS configuration, and malvertising to send victims to an AiTM phishing page while bypassing common URL-based defenses, according to Push Security. The pattern shows that delivery trust assumptions, not just phishing page quality, are now the weak point in identity attack detection.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “How attackers are using Active Directory Federation Services to phish with legit office.com links”.
Key questions
Q: What breaks when phishing delivery uses trusted redirect chains instead of obvious malicious URLs?
A: URL reputation and destination filtering break first, because the attacker can hide behind legitimate services until the final redirect.
Q: Why do ADFS and SSO redirects make phishing harder to detect?
A: They borrow legitimacy from identity infrastructure that users and security tools already expect to see during sign-in.
Q: How can security teams reduce risk from malvertising-led phishing campaigns?
A: They should extend monitoring beyond email and into search, ad traffic and browser telemetry, because many lures now begin outside the inbox.
Practitioner guidance
- Monitor federation redirects for unexpected domain hops Alert when Microsoft sign-in URLs redirect into non-approved domains, especially when the path includes ADFS-style patterns that do not match your legitimate tenant footprint.
- Trace phishing incidents through browsing chains Use browser and proxy telemetry to reconstruct the full redirect chain from lure source to landing page so analysts can see the invisible hops that URL filters miss.
- Block or scrutinise ad-supported lure paths Treat search ads and sponsored links as phishing delivery vectors, not just email alternatives, and monitor for clicks that lead to identity prompts through redirect services.
Bottom line: Trusted redirect chains let phishing campaigns inherit legitimacy from Microsoft login flows, ADFS and search-ad entry points before the final malicious handoff.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:25 am
Trusted delivery paths have become part of the phishing attack surface: Security teams still treat the final destination URL as the primary signal, but this attack shows that the delivery chain itself can be weaponised. When Microsoft login redirects, ad-click paths and federation hops look legitimate in isolation, URL-based defenses lose their most reliable assumption. The practitioner takeaway is that phishing detection now has to inspect the journey, not just the landing page.
A question worth separating out:
Q: How should IAM teams decide whether a redirect chain is suspicious or legitimate?
A: They should compare the observed redirect path against known-good identity flows, approved domains and expected federation behaviour. Any transition that moves from a trusted sign-in service into an unapproved tenant, path or domain should be treated as an authentication risk until proven otherwise.
👉 Read our full editorial: Phishing detection evasion is shifting to trusted redirect chains
This post was modified 1 day ago by NHI Mgmt Group