HolaBrief/LoopedIn Multi-Hop SaaS Open-Redirect Phishing Chain

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects email-based phishing attempts that utilize a two-hop open-redirect mechanism by abusing legitimate SaaS platforms (holabrief.com and loopedin.io). It flags emails containing specific redirect links, often used to bypass traditional security filters by redirecting users through trusted domains before reaching a malicious destination.