Executive Summary
A sophisticated phishing campaign has been identified using the forged identities of established healthcare organizations to bypass reputation-based filters. The attackers leverage the trust associated with domains registered as far back as 1995 while simultaneously exploiting open-redirect vulnerabilities in legitimate SaaS platforms like HolaBrief and LoopedIn.
The attack chain involves an invoice-themed email with a call-to-action (CTA) button that routes victims through multiple legitimate SaaS hosts. This technique effectively hides the final malicious destination from automated URL scanners that only evaluate the first hop of a redirect chain. Despite the use of aged domains, the campaign exhibited clear authentication failures, including broken DKIM signatures and DMARC quarantine triggers, which were key indicators for behavioral detection systems.