Phishers Weaponise “Safe Links” Using Multi‑Layered URL Rewriting

Du'aine Davis

Observed in the wild

• LevelBlue SpiderLabs identified a sharp rise in phishing campaigns abusing URL rewriting between Q2–Q4 2025, peaking in January 2026. The activity primarily targeted Microsoft 365 users, including professional services such as law firms, using trusted “safe link” domains to conceal malicious destinations and enable credential theft and account takeover.
• Threat actors operating phishing‑as‑a‑service platforms (Tycoon2FA, Sneaky2FA) abused compromised email accounts to generate “trusted” rewritten links, then chained multiple security vendors’ URL rewriting services. These multi‑layer redirect chains evade link scanning and support AiTM attacks, capturing credentials and MFA session cookies.
• Organisations are advised to prioritise behaviour‑based detections in Microsoft Defender, monitor for excessively long or multi‑redirect URLs, and alert on post‑sign‑in anomalies (new mailbox rules, atypical sign‑ins). Enforce phishing‑resistant MFA, inspect HTTP 302 redirect chains, and train users to report unexpected authentication prompts, even when links appear to come from trusted security domains.

Weaponizing Safe Links: Abuse of Multi-Layered URL Rewriting in Phishing Attacks

Du'aine Davis

Tycoon2FA Evolves Towards Device Code Phishing After Takedown
Observed in the wild

• In April, a rebuilt Tycoon2FA campaign emerged roughly 20 days after the March takedown, targeting enterprise Microsoft 365 users. The activity shows continuity in credential theft operations but reflects a shift in tradecraft, aligning with recent reporting of device code phishing as actors adapt to bypass traditional MFA protections and maintain account takeover capability.
• Tycoon2FA retains AiTM infrastructure but increasingly supports device code phishing flows, removing the need for direct credential interception. Lures are hosted on AWS S3 and routed through multiple redirect layers and CAPTCHA gates. Heavy obfuscation (six layers) protects payload delivery and infrastructure, while backend changes (e.g., CDN migration) demonstrate active evasion and resilience following disruption.
• Organisations are advised to restrict or tightly control Microsoft device code authentication flows and monitor for abnormal device registrations and token issuance in Entra ID. Use Microsoft Defender to detect suspicious sign-ins linked to device code flows, unusual session persistence, and token misuse. Enforce phishing-resistant MFA (FIDO2), apply Conditional Access to limit device enrolment, and investigate sign-ins preceded by multi-stage redirect or CAPTCHA-based phishing chains.

Tycoon2FA Rebounds Post-Takedown with 6 Layers of… | Abnormal AI