A malicious redirect sends a user from a legitimate site to a fraudulent or harmful destination without their informed consent. Attackers use redirects to drive phishing, credential theft, or malware delivery. In client-side supply chain incidents, the redirect may happen automatically when the compromised resource loads.
Expanded Definition
A malicious redirect is a trust-breaking transfer from a legitimate starting point to an unintended destination. It may be triggered by a manipulated link, a compromised application, a poisoned script, or a browser-side flow that quietly changes the destination after the user has already judged the original site to be safe.
The defining issue is not simply that a redirect occurs, but that the user’s trust in the original origin is abused. That distinction matters because a normal redirect can be legitimate for login flows, content delivery, or site restructuring, while a malicious redirect changes the security meaning of the journey. In practice, the attacker wants the victim to keep the credibility of the first site while landing on a different one that can harvest credentials, inject malware, or stage a lookalike page. In client-side supply chain cases, the redirected outcome may be caused by third-party code rather than the site owner’s visible content.
Guidance vs consensus: security teams generally agree that the risk comes from destination deception and trust abuse, but the boundary between a benign redirect and a malicious one depends on context, control, and user expectation.
Examples and Use Cases
Malicious redirects appear in both web abuse and broader delivery chains. They are often used because they are simple, scalable, and effective at disguising the attacker’s real destination.
- A phishing email links to a legitimate-looking site that immediately forwards the browser to a fake sign-in page.
- A compromised advertising or analytics script on a trusted page silently redirects visitors to a scam or malware-hosting domain.
- A URL shortener or open redirect on a trusted domain is chained into a credential-harvesting campaign.
- A browser-based checkout or login journey is altered so the user is sent to an attacker-controlled payment or session-capture page.
- A client-side supply chain incident causes the redirect to happen automatically when the compromised resource loads, even though the site owner did not intend it.
The main tradeoff for defenders is usability versus strictness: many legitimate workflows depend on redirects, so blocking them blindly can break authentication and navigation. A OWASP Non-Human Identity Top 10 reference is not directly about malicious redirects, but it becomes relevant when redirects are part of a broader compromised integration chain that exposes machine trust paths.
Security Implications
Malicious redirects are dangerous because they convert a trusted entry point into an untrusted one without obvious visual change at the moment of user decision. That can defeat careful user behavior, weaken domain-based trust cues, and reduce the value of awareness training when the visible first hop looks legitimate.
The immediate consequence is often credential theft, session hijacking, or malware delivery. The broader consequence is loss of assurance about where a user actually ended up, which complicates incident response and phishing investigation. In client-side compromise scenarios, the redirect can affect every visitor who loads the poisoned resource, so the blast radius may be much larger than a single targeted victim. A common practitioner failure is treating redirects as harmless plumbing rather than as a security boundary that can be abused to move users across trust domains.
Observable symptoms include unexpected destination changes, unusual redirect chains, login pages that appear after a trusted click, and traffic patterns that do not match the page or campaign the user intended to access.
Domain and Governance Relevance
Malicious redirect matters most in web security, phishing defense, and supply chain assurance. Its governance value comes from forcing teams to treat destination control as part of trust management, not just a routing convenience. When redirects are allowed in user journeys, ownership of the redirect source, destination validation, and change control needs to be clear.
Where identity is involved, the impact is sharper: a redirect that lands on a spoofed login page can undermine authentication assurance even when the original website was legitimate. That means security teams should consider redirect behavior alongside login integrity, third-party script governance, and link-handling policy. The important question is not only “was the source trusted?” but “was the destination controlled and expected?”
For NHIMG readers, the key governance lesson is that trust transit is part of the attack surface. If a redirect path can be altered, the user’s security decision can be detached from the true destination.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204 — User Execution | Malicious redirects rely on user interaction or script-driven navigation to reach the attacker destination. |
| T1566 — Phishing | Malicious redirects commonly serve phishing by hiding the final destination behind trusted links. | |
| Recommendation — Map redirect-led delivery to T1204 and inspect click-through and browser execution paths for abuse. Treat redirect chains as phishing infrastructure and hunt for destination concealment patterns. | ||
| CIS Controls v8 | 8 — Audit Log Management | Redirect abuse is often detected through anomalous request chains, referers, and destination logs. |
| 5 — Account Management | Redirects frequently target login journeys and account capture through lookalike destinations. | |
| Recommendation — Centralise and review redirect and web access logs to spot unexpected destination changes. Harden account-entry journeys so users are not steered into fake authentication endpoints. | ||
| NIST CSF 2.0 | PR.DS — Data Security | Redirect abuse often supports credential theft, malware delivery, and integrity loss through trust abuse. |
| Recommendation — Apply PR.DS controls to protect user flows from destination tampering and payload delivery. | ||
Related resources from NHI Mgmt Group
- Who is accountable when forged DNS responses redirect users to malicious sites?
- How should security teams reduce the impact of malicious redirect chains?
- Why do malicious return URL or redirect parameter flaws create account takeover risk in federated login flows?
- What happens when attackers redirect Redis internals to control malicious behaviour?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
