The article describes two phishing campaigns discovered via VirusTotal monitoring that use multi-stage URL redirection across legitimate cloud platforms and newly registered domains to evade detection. The first campaign abuses the Framer no-code website builder and Cloudflare Workers, using a custom CAPTCHA, Web Crypto API decryption, and HTML5 Blob-based smuggling to assemble a fake Google sign-in page in browser memory. The second campaign chains randomized alphanumeric domains, a .shop domain, and a final newly registered domain to deliver a device code phishing page impersonating OneDrive, with both pages employing anti-debugging JavaScript to hinder analysis.
Multi-Stage Redirection
1 post
The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains