Multi-Vendor URL Rewrite Chaining

Ankit Mehta@Secvyn

•updated Mar 17, 2026•11•1•113

Detects incoming emails where a single URL contains indicators of two or more distinct security vendor rewriting services. This technique is used by adversaries to create multi-layered redirect chains to bypass automated scanners and deliver malicious content, as seen in Tycoon2FA and Sneaky2FA campaigns.