TA419 benign-pretext email later followed by shortened-URL phishing pivot

Arnold Chan@slaz

•updated 25 days ago•2•0•6

Detects a multi-stage social engineering chain attributed to TA419. The activity begins with a benign trust-building email from specific domains or addresses, followed by a subsequent email to the same recipient containing a link to a known URL shortener or redirector, indicating a potential AitM phishing sequence.