Healthcare Phishing Two-Hop SaaS Redirect via HolaBrief and LoopedIn

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects potential phishing activity involving a two-hop open-redirect chain. The rule monitors for an initial navigation to known SaaS platforms (HolaBrief or LoopedIn), followed within one minute by an outbound request to an external destination where the SaaS domain is present in the HTTP referrer header, indicating a redirect-based phishing mechanism.