When A Google Link Becomes A Trojan Horse: Dissecting A Redirect-to-Phish Campaign

27 October 2025by Cyber Shield Intelligence (CSI) Team

You’ve probably clicked a Google link hundreds of times without thinking twice, after all, what could be safer than a Google domain? But what if that familiar blue link was actually the doorway to a fake Microsoft login designed to steal your credentials?

That’s exactly what’s happening in this attack chain, where cybercriminals cleverly weaponize Google redirect phishing attacks to disguise their true destination. What looks like a routine sign-in prompt quickly turns into a credential-harvesting trap, and even your automated scanners might follow it right into danger.

In this blog, we’ll unpack how this phishing technique works, step through the redirect chain, and show how attackers exploit trust in legitimate domains to bypass modern security controls. We’ll also share how to detect and defend against these redirects using Microsoft Defender and Sentinel, and how Wizard Cyber helps organizations stay ahead of evolving phishing tactics.

Table of Contents

TL;DR

How the Phishing Chain Unfolds

Behind the Scenes: The Redirect Tricks

How to Investigate Safely

Red Flags to Watch For

Why This Is Important

Recommendations for Detection and Prevention

TL;DR - What Happened

The attacker used an intermediate Google redirector URL (https://google.sm/url?…q=…) which then leads to another URL (https://sepro.com.pe/jamb/) that finally ends up at a malicious fake Microsoft login page.

The initial GET returned HTTP/2 301 with a Location: header pointing the browser at the Google redirector target; following the chain returned a webpage titled “Redirect Notice” and then the phishing site.

Attackers use legitimate redirectors and chained redirects to hide the final malicious domain, bypass filters, and increase click-through trust.

Defend with email auth checks (SPF/DKIM/DMARC), link-unfurling engines, redirect analysis, user education, and rapid incident response when credentials are suspected.

How the Phishing Chain Unfolds

Phishing email delivery
- The email claims urgency (subject: “Logon Expiry…”). Sender address is suspicious/obfuscated (long concatenation, domain hyten.com), and the message embeds a URL that points to a Google redirector (google.sm) instead of the final destination.
- Why use a Google redirect? google.sm is a Google-managed redirect domain; attackers can sometimes abuse legitimate redirectors, or simply encode the malicious URL in a parameter. This can help bypass naive blocklists and make recipients trust the link.
User clicks the link
- The link is of the form:
  https://google.sm/url?q=https://sepro.com.pe/jamb/&sa=D&…&usg=AOvVaw…
- The browser requests the google.sm URL. The server responds with a 301 Moved and a Location: header pointing to the same URL (or to https://www.google.sm/…). In your trace the response body also contains a small HTML “301 Moved” page.
Redirect chain continues
- The redirector then serves a “Redirect Notice” (seen in the HTTP/2 200 response) that points the browser to https://sepro.com.pe/jamb/. That resource may itself:
  - Serve an HTML page that immediately redirects (meta refresh or JavaScript).
  - Host an HTTP 3xx redirect to the attacker-controlled domain.
  - Redirect server-side to a malicious host that hosts the fake Microsoft login page.
Final landing: fake Microsoft login

- The user arrives at a page visually mimicking Microsoft login. If credentials are entered, they go to the attacker.
- The attacker might record credentials, try to reuse them, or pivot into the victim’s systems.

Behind the Scenes: The Redirect Tricks

Open redirect abuse: if sepro.com.pe has an open redirect (e.g., /redirect?url=) attackers can send victims there and then to a malicious site.
Compromised legitimate site: the attacker could have compromised sepro.com.pe and added a redirect or malicious page at /jamb/.
URL shortening / obfuscation: Using google.sm or other redirectors to hide the final hostname and evade blocklists.
Parameter encoding and fragments: The attacker can encode payloads (e.g., base64 blobs or query parameters) so that scanners don’t easily extract the final malicious host. You even showed a base64-like fragment in the email.
TLS and lookalike certificates: The malicious host may have a valid TLS cert (Let’s Encrypt), which makes it look even more legitimate.
Referrer & tracking exploitation: redirect notice scripts can leak referrer data or track clicks, letting attackers know which addresses are vulnerable.

How to Investigate Safely

These checks are defensive and investigative — use them to analyze suspect links safely (from a sandbox or isolated environment):

Quick header-only follow/no-follow:# show only headers, no redirects
curl -I –max-redirs 0 “https://google.sm/url?q=https://sepro.com.pe/jamb/&sa=D…”
# follow redirects and show trace
curl -v -L “https://google.sm/url?q=…”
Show redirect chain URLs only:curl -s -o /dev/null -w “%{url_effective}\n%{http_code}\n” -L “https://google.sm/url?q=…”
Inspect certificate details:openssl s_client -connect sepro.com.pe:443 -showcerts
DNS / IP / WHOIS:dig +short sepro.com.pe
whois sepro.com.pe
Email auth checks (from your mail server or from logs):dig TXT hyten.com +short # SPF record
# Check DMARC record
dig TXT _dmarc.hyten.com +short
Passive checks: query passive DNS and URL scanning services (VirusTotal, etc.) from secured environment to see if final URL is known malicious.

Red Flags to Watch For

Long, obfuscated sender address and odd domain (hyten.com).
Urgent “Logon Expiry” wording to induce panic and clicks
Google redirector in the URL (google.sm/…q=…) used to hide the final host.
Base64-like or encoded payloads in query string or fragment.
Final page looks like Microsoft sign-in but is not at microsoft.com (domain mismatch).
TLS cert that doesn’t match branding or freshly issued certs can be a red flag.
SPF/DKIM failures (check mail headers) or DKIM signatures that don’t validate.

Why This Is Important

Phishing actors are becoming masters of disguise, now exploiting the very brands people trust most, like Google, Microsoft, and LinkedIn, to mask malicious intent.

In 2025, Wizard Cyber’s SOC teams have observed a sharp rise in campaigns using redirects and legitimate certificates to slip past traditional filters and user suspicion.

Because the visible domain often belongs to a trusted platform, even vigilant users can be misled, and the use of TLS and valid HTTPS certificates adds another layer of credibility.

These attacks don’t just stop at stolen credentials. Once inside, adversaries can pivot to data theft, lateral movement, and impersonation, creating lasting damage for organizations and their clients.

Recommendations for Detection and Prevention

Strengthen Email and Web Defenses
a. Enforce SPF, DKIM, and DMARC to validate legitimate senders.
b. Leverage Defender for Office 365 Safe Links and Safe Attachments to analyze redirects and detonate suspicious payloads.
c. Configure policies to block or alert on messages containing multiple chained redirects.
Build User Awareness
a. Include targeted awareness training emphasizing URL inspection, especially when links contain q= or encoded parameters.
b. Encourage users to verify the true login domain before entering credentials , even if the page “looks” official.
Harden Authentication Security
a. Enforce Multi-Factor Authentication (MFA) for all accounts, prioritizing phishing-resistant FIDO2 methods.
b. Use Microsoft Entra ID sign-in logs and Defender for Identity to detect unusual or high-risk login attempts post-phishing.
Strengthen Incident Response
a. Immediately reset credentials, revoke tokens, and invalidate active sessions for affected accounts.
b. Contain the threat by blocking malicious domains and IPs at the proxy and firewall level.
c. Correlate activity through Microsoft Sentinel to detect related follow-up attempts.

CYBERSECURITY READINESS

Strengthen Your Cyber Defences Today

As cyber threats grow more complex, proactive detection is no longer optional.

With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.

Start your journey to smarter, faster cybersecurity today.

EXPLORE MORE

Related Blogs & Insights

Discover blogs that deepen your knowledge and accelerate your security strategy.

CoPhish – New Phishing Technique Using CoPilot

CoPhish uses Copilot Studio to steal OAuth tokens via trusted Microsoft domains. Learn how the attack works and how to defend against it.

Trusted Services As Phishing Vectors: Techniques, Evasion, And Defensive Controls

Learn how attackers exploit trusted services for phishing and how Wizard Cyber detects and defends against these subtle threats.

From IDE To Initial Access: Hunting Malicious VS Code Extensions (GlassWorm, WhiteCobra & Copycats)

Detect and stop malicious VS Code extensions stealing credentials and sensitive data from developer environments.

Dyaa Soussan

Cyber Shield Intelligence (CSI) Team

Wizard Cyber’s first line of defense in proactive threat intelligence. CSI is dedicated to the identification, monitoring, and analysis of emerging cyber threats, including activity across the dark web, underground forums, and threat actor infrastructure. Leveraging advanced threat intelligence platforms, OSINT tools, and adversary tracking methodologies, the team provides actionable intelligence to anticipate attacks before they occur. With expertise in threat actor profiling, TTP mapping (aligned with the MITRE ATT&CK framework), and IOC enrichment, CSI equips clients with the critical insights needed to fortify defenses, mitigate risk, and stay ahead of evolving threat landscapes.

Microsoft Sentinel’s Evolution: A Unified Experience in the Defender Portal

Securing the Digital Bank: how MXDR solution protects financial workloads 24x7x365

WIZARD CYBER