KnowBe4

Trust Is the Redirect: How a Google Redirect Link Carries Victims to Fake Webmail Logins KnowBe4 ThreatLabs is tracking a phishing campaign that uses different brand lures to harvest M365 credentials. The analysis uncovered the fake login pages impersonating multiple services across multiple countries including a government portal. The CTA link is wrapped in a Google redirect and carries the recipient's email address. The Hook: Emails styled as voicemail, ACH payment, fax or year-end dinner invitations from recognized brands such as Adobe, FedEx, QuickBooks and RingCentral. Each one references the recipient's own organization. The Bridge: The button link goes through Google’s own redirector (images[.]google[.]pl/url?q=, and carries the recipient’s email address. The first domain in the link belongs to Google, so filters and users tend to trust it. The destination is the attacker’s page. The Mask: The click lands on a fake login page for M365 or a clone of a local webmail service in the UAE, Japan, Finland or Argentina. The Prize: A short PHP script collects the username, password and victim IP address, then emails them to an attacker-controlled mailbox with PHP's mail() function. No collection server is needed, only a mailbox. WHY IT WORKS: The link starts with a trusted Google domain. The login page is one the victim already knows. The email address is pre-filled. And the theft needs nothing more than an email account. Impersonated Sites eim[.]ae - Etisalat by e& Internet Mail, the email system of a major telecom provider (United Arab Emirates) eowebmail[.]eonet[.]jp - eo Webmail, email service for OPTAGE broadband subscribers (Japan) webmail[.]megaegg[.]ne[.]jp - MEGA EGG Webmail, internet provider run by the Chugoku Electric Power group (Japan) wmail[.]aitai[.]ne[.]jp - Aitai net Webmail, regional cable internet provider (Japan) fimnet[.]fi - Fimnet, secure network for licensed doctors and pharmacists (Finland) rcmail[.]mendoza[.]gov[.]ar - Webmail Gobierno de Mendoza, email system for employees and agencies of the Province of Mendoza (Argentina) #Phishing #ThreatIntel #KnowBe4ThreatLabs #CredentialHarvesting #M365 #BrandImpersonation #Webmail #InfoSec #IOC

The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust blog.knowbe4.com/the-rise-of…

Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days. HOW IT WORKS: The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath. The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials. WHY IT MATTERS: On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator: Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48. Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account. Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs. WHAT DEFENDERS SHOULD DO: Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually. #Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec

Are Your AI Assistants the Next Attack Surface? blog.knowbe4.com/are-your-ai…