Phishing Campaign Used Redirect Chains to Evade Email Spam Filters

Summary

A reported campaign routed links in emails impersonating encrypted Mimecast messages through Riddle Technologies infrastructure and a CAPTCHA to a fake Gmail login page. Forensic analysis indicated the spoofed domain had been active for at least 26 days.

Key points

The reported campaign used Riddle Technologies AG infrastructure to obscure malicious links and bypass spam filters.
Emails mimicked encrypted Mimecast messages, and embedded links passed through an intermediary landing page before reaching a phishing page.
Recipients who clicked “sign documents” encountered a CAPTCHA before a page impersonating Gmail login that harvested credentials.
Forensic analysis indicated the spoofed domain had been active for at least 26 days.

Article Details

Event Type: Phishing campaign using redirect chains to obscure malicious URLs and bypass email spam filters.
Impact: Recipients who clicked “sign documents” were routed through a CAPTCHA to a credential-harvesting page impersonating Gmail. The article says the spoofed domain had been active for at least 26 days.

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe phishing page impersonated Gmail to harvest credentials.T1566.002 · Spearphishing LinkThe campaign used malicious links embedded in a phishing email.

Vendors

Riddle Technologies AGThreat actors leveraged the Riddle Technologies AG platform to obfuscate malicious URLs in email and bypass spam filters. The email template mimicked an encrypted Mimecast message: shconsult.ing/njZs4vtm

Products

Gmail‍Victims clicking "sign documents" were routed through CAPTCHA before reaching a credential harvesting page impersonating Gmail login: shconsult.ing/f48zvJb5 MimecastThreat actors leveraged the Riddle Technologies AG platform to obfuscate malicious URLs in email and bypass spam filters. The email template mimicked an encrypted Mimecast message: shconsult.ing/njZs4vtm