However, attackers could abuse open redirects to link to a URL in a trusted domain and embed the eventual final malicious URL as a parameter. For example, sales and marketing campaigns use this feature to lead customers to a desired landing web page and track click rates and other metrics. The use of open redirects in email communications is common among organizations for various reasons. This ultimately leads to credential compromise, which opens the user and their organization to other attacks. Doing so leads to a series of redirections-including a CAPTCHA verification page that adds a sense of legitimacy and attempts to evade some automated analysis systems-before taking the user to a fake sign-in page.

Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking. Microsoft has been actively tracking a widespread credential phishing campaign using open redirector links. Microsoft Purview Data Lifecycle Management.Microsoft Purview Information Protection.Information protection Information protection.Microsoft Priva Subject Rights Requests.Microsoft Purview Communication Compliance.Microsoft Purview Insider Risk Management.Risk management & privacy Risk management & privacy.Microsoft Defender External Attack Surface Management.Microsoft Defender Vulnerability Management.Azure Active Directory part of Microsoft Entra.

List of current phishing scams