Phishing redirectors forward chosen victims to a hidden credential page, and AiTM kits relay your MFA. See how the chain works and which defenses hold up.
A phishing redirector is a middle step between the email and the real phishing page. The link in the email points to an innocent-looking page, often on a hacked legitimate site. That page quietly forwards chosen visitors to the real credential-stealing page, and shows everyone else something harmless. It protects the attacker’s real infrastructure and defeats checks that only inspect the link in the email.
A redirector turns one link into a chain. Each step has a job, and most of them help the attacker hide.
| Step | What happens | Why it helps the attacker |
|---|---|---|
| Email link | The message links to an ordinary-looking page | The first URL carries no bad reputation |
| Redirector | The page decides who gets forwarded | Scanners and bots see a decoy instead |
| Filter | Checks for bots, location, or device | Keeps researchers away from the real page |
| Fake login | The target sees a copy of a real sign-in page | Captures the password |
| Relay | The kit passes the login to the real service | Captures the MFA code and session |
Phishing kits sold as a service build this logic in. Microsoft’s analysis of the Tycoon2FA kit describes pre-built templates, domain and hosting setup, redirect logic, and victim tracking, including intermediate pages and decoy destinations. That is why even low-skilled criminals can run a convincing chain. Phishing as a service sells exactly that convenience.
Many email defenses check the link in the message. They look at the domain’s reputation, its age, and whether it appears on a blocklist. A redirector weakens each of those checks.
First, the link in the email often points at a compromised but otherwise legitimate site. Its reputation is fine. Second, the redirector shows scanners a decoy, so an automated visit sees nothing wrong. Third, the real phishing page never appears in the email at all, so blocking the visible link does not touch it.
Blocking the redirector also becomes a game of whack-a-mole. Attackers use disposable hacked sites, then abandon them. Link checks still catch some chains. But relying on link reputation alone leaves a gap, and attackers know where it is.
Discover how Threatcop protects your workforce from modern cyber threats.
The most dangerous users of redirect chains are adversary-in-the-middle, or AiTM, kits. They sit between the victim and the real service. The victim types a real password and approves a real MFA prompt. The kit relays both and keeps the session.
Campaigns reach targets by link, attachment, and QR code, and QR code phishing uses the same redirect tricks. Tycoon 2FA is the best-known AiTM example. Researchers at Sekoia first documented it in 2023. Its flow includes bot filtering, extra redirects, a fake Microsoft login, and a relayed 2FA step. Researchers at eSentire also noted that it uses a CAPTCHA, which gives staff a useful clue: a “verify you are human” step before a login page is odd.
The scale was large. BleepingComputer reported that Microsoft saw Tycoon2FA generate 30 million phishing emails a month, about 62% of the emails Microsoft blocked. A coalition seized 330 of its domains in March 2026. CrowdStrike saw volume fall to 25% of its earlier level for a day or two, and then return to pre-disruption levels.
The lesson is plain. Takedowns help, but demand keeps the ecosystem alive.
An AiTM kit defeats ordinary MFA by relaying it. The kit forwards the code to the real service and captures the resulting session. The attacker then holds a valid login without ever knowing the second factor. This is a form of credential harvesting that steals the session along with the password.
That does not make MFA useless. It makes the type matter. CISA says that not all forms of MFA are equally secure. Some are open to phishing, and it calls phishing-resistant MFA the gold standard. Hardware keys and passkeys bind the login to the real site, so a relay on a fake domain fails.
No single control wins here. Layer these:
If you suspect a phishing redirector chain, speed matters, so keep the steps short and clear.
A redirector hides the dangerous page from tools. It cannot hide it from a person who clicks, sees a login page that feels wrong, and says so. That report is often the first real signal, because the link in the email looked harmless.
Threatcop Phishing Incident Response (TPIR) gives that person a one-click way to report from email or WhatsApp. They can check a message’s threat level before they decide. TPIR then runs header analysis, link and file scanning, an IP reputation check, and fake domain checks in a sandbox, so the security team gets an assessment rather than a guess.
Its “Who Else” insight then shows which other mailboxes received the same message. Genuine mail returns to the inbox, and TPIR deletes malicious mail. Because one chain usually reaches many people, that step matters as much as the first report.
Phishing redirectors exist because link checks work. Attackers add a hidden step to defeat them, and AiTM kits add a relay to defeat ordinary MFA. So defend in layers. Use phishing-resistant MFA for accounts that matter most. Teach staff to check the address bar and to treat an unexpected CAPTCHA as a warning. Watch sign-ins for new places and devices. And make reporting a one-click reflex, because the person who sees the fake login is often the first, and sometimes only, sensor that catches the chain, so give people a fast, blame-free way to say what they saw.
A phishing redirector is an intermediate page that forwards selected visitors to the real phishing page and shows others something harmless. It hides the attacker’s real infrastructure and helps the chain avoid scanners that inspect only the link in the email.
Phishing redirectors often sit on hacked legitimate sites with clean reputations. They also show scanners a decoy, and the real phishing page never appears in the email. Tools that judge only the visible link can therefore miss the chain.
An adversary-in-the-middle phishing kit sits between the victim and the real service. It relays the real login and MFA step, then captures the session. Tycoon 2FA is a well-known example, documented by Sekoia and analyzed by Microsoft Threat Intelligence.
Ordinary MFA often cannot, because the kit relays the code to the real service. Phishing-resistant MFA, such as hardware keys and passkeys, can stop it, because it ties the login to the genuine website. Learning how to recognize phishing emails adds a human check.
Look for a login page you reached through a link you did not expect, an odd domain in the address bar, or a CAPTCHA before the sign-in. If anything feels wrong, close the page and report the message. Do not enter a password.
Adhish Chakma is a Senior Product Manager at Kratikal, where he leads product initiatives focused on cybersecurity and AI-powered solutions. With experience in product management and cybersecurity, he works on developing practical technologies that address evolving security challenges. His areas of interest include People Security Management, cybersecurity awareness, AI-driven security, email security, and human-layer risk. He is passionate about building security products that make organizations more resilient against emerging cyber threats.
AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train...
Help desk impersonation, fake booking-site emails, and vendor risk drive travel cyber losses. See the patterns, the MGM figures,...
Teen-led groups hit M&S, Co-op, and Harrods through help desk calls. See why young people turn to hacking and...
