Trusted Domain, Untrusted Destination: Open-Redirect Phishing

A finance clerk at Larkfield Mutual Assurance clicks a Release My Messages link in an Undelivered Mails phishing email. The link opens with a trusted brand domain that carries an open-redirect flaw, so it sails past URL filtering. Follow the 302 redirect through an attacker cushion server and a JavaScript hop to a spoofed Microsoft 365 login page, then catch the harvested credentials being replayed against the real tenant. Walk the mail gateway, web proxy, and sign-in logs step by step.