A new phishing campaign utilizes legitimate, compromised websites to bypass email security.
The so-called ‘Bulletproof’ Blind Redirector Kit ensures that the actual phishing infrastructure remains invisible to traditional email filters and users. KnowBe4 Threat Lab discovered that between late April and mid-July, thousands of phishing emails using this technique landed in users’ inboxes.
The phishing links in these emails initially point to reliable but compromised websites. Only after clicking is the user imperceptibly redirected to a phishing page, ensuring the final destination remains hidden from email security systems.
The method makes detecting and blocking phishing significantly more difficult. Organizations relying on traditional multi-factor authentication (MFA) are also at risk, as attackers use techniques to intercept authenticated sessions in real time.
Blind redirectors
The core of this attack method is the use of a so-called blind redirector. In this process, a legitimate but compromised website acts as an intermediary. As a result, the actual phishing infrastructure remains invisible during checks by Secure Email Gateways. Attackers can quickly switch compromised hosts, making blocking more difficult.
Behind this intermediate layer, AiTM phishing kits such as Sneaky2FA and Tycoon 2FA are deployed. These allow attackers not only to bypass the victim’s MFA check but also to directly intercept the authenticated session. This means that traditional MFA no longer provides adequate protection against these types of attacks.
Abuse of known infrastructure
According to KnowBe4, 34 percent of phishing emails utilized the sending infrastructure of well-known brands such as QuickBooks and DocuSign. Additionally, dozens of legitimate websites from various countries and sectors have been compromised to act as redirectors. By using trusted names and existing reputations, attackers not only bypass technical security but also increase the likelihood of victims clicking the link.
The rise of blind redirectors demonstrates that phishing is becoming increasingly difficult to recognize and block. Organizations would be wise to adapt their security, for example, by implementing phishing-resistant MFA and continuing to focus on employee awareness.