How often are redirects used in phishing in 2026?, (Mon, Apr 6th)
2026-04-06T13:23:49Z•d20662e66fcc4f3a662df6c36cd8db57613abb8b45575add6ed97c8eeba1e3c2
CERT-EUCVE-2025-30208European-CommissionMandiantSaaS-compromiseSportradarTeamPCPViteapplication-control-bypasscloud-breachdata-exfiltrationexploitationfileless-malwareopen-redirectphishingregistry-persistencesecurity-advisorysupply-chain
What happened
Collection of ISC SANS diary entries (Apr 1–6, 2026) covering: research into how open redirects are abused in phishing campaigns; ongoing TeamPCP supply-chain campaign updates (CERT‑EU confirmation of a European Commission cloud breach, Sportradar disclosures, and Mandiant reporting ~1,000+ impacted SaaS environments); observed attempts to exploit exposed Vite installs (CVE-2025-30208); a fileless/malicious script using registry persistence to remove ads; and techniques for application-control bypasses used to enable data exfiltration.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- d20662e66fcc4f3a662df6c36cd8db57613abb8b45575add6ed97c8eeba1e3c2
- Enrichment time
- 2026-04-06T13:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.