Selective redirection

Expanded Definition

Selective redirection is an attack pattern in which an adversary routes only specific users, sessions, or requests to malicious infrastructure while leaving the rest of a service seemingly normal. In NHI and identity operations, that makes it a stealth tactic for credential theft, token interception, session hijacking, or tampering with agent workflows without triggering broad outages. The behavior is often aligned with espionage goals because it preserves the appearance of service health while targeting high-value identities or actions. Guidance varies across vendors on whether this is treated as phishing infrastructure, traffic manipulation, or a broader evasion technique, so practitioners should anchor the term to observable routing behavior and outcome. This pattern is easier to miss when monitoring focuses on aggregate availability rather than per-identity request paths, and it becomes more dangerous when AI agents, service accounts, or API keys are allowed to reach tools without strong provenance checks. The most common misapplication is assuming a stable-looking service is clean, which occurs when only a narrow identity slice is being redirected.

For a control-oriented view of identity risk, see the NIST Cybersecurity Framework 2.0 and NHIMG’s Ultimate Guide to NHIs — 2025 Outlook and Predictions.

Examples and Use Cases

Implementing detection for selective redirection often introduces telemetry complexity, requiring organisations to weigh finer-grained visibility against noise, cost, and privacy constraints.

• A phishing page proxies normal traffic for most visitors, but sends executives and cloud administrators to a credential-harvesting clone after their user agent or IP is recognized.
• A malicious reverse proxy forwards ordinary browsing correctly, while redirecting only login requests from service accounts to capture tokens and refresh secrets.
• An attacker compromises DNS or routing for a subset of regional users, exposing only the security team to a fake update portal while general customers see the legitimate site.
• A hostile middleware layer in an AI workflow sends only high-privilege agent prompts or tool calls to a tampered endpoint, leaving low-risk requests untouched.

Selective redirection is easier to spot when request logs are correlated with identity context, network path, and token usage patterns. NHI-focused governance guidance from the Ultimate Guide to NHIs — 2025 Outlook and Predictions is most useful when paired with external identity and monitoring baselines such as the NIST Cybersecurity Framework 2.0.

Why It Matters in NHI Security

Selective redirection matters because it undermines confidence in authentication, routing, and agent execution without creating obvious service failure. That makes it especially relevant where NHIs hold durable access, because one redirected API key, service account, or agent callback can expose secrets, alter automation, or silently approve malicious actions. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, which means most teams are poorly positioned to notice when only a narrow identity slice is being manipulated. It also matters for incident response: if defenders do not distinguish between ordinary traffic and identity-targeted traffic, they can miss the path of compromise and misclassify an espionage operation as routine user error. NHI governance should therefore treat unusual per-identity routing as a security event, not just a network anomaly. The practical lesson is that redirection controls, trust signals, and secret hygiene need to be reviewed together, not in separate silos.

Organisations typically encounter the full impact only after a high-value token is abused or an agent task is silently altered, at which point selective redirection becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Key Redirection
• Selective Data Residency
• Selective openness
• Selective Disclosure