Multi-Stage Phishing Redirects to Credential Page

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•4

Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.