Phishing Pages Delivered Through Refresh HTTP Response Header
Summary: Unit 42 researchers observed large-scale phishing campaigns in 2024 that used a refresh entry in the HTTP response header, detecting around 2,000 malicious URLs daily from May through July. The emails carried recipients' addresses and displayed spoofed webmail login pages pre-filled with user information, targeting the global financial sector, internet portals and government domains, with over 36% of detections aimed at the business-and-economy sector.
Why it matters: Because the redirect happens in the response header before any HTML is processed and the original and landing URLs often sit on legitimate or compromised domains, there is little in a URL string for a user or filter to flag. One campaign alone hit over 3,000 victims across more than 500 organizations, and the researchers found no legitimate websites exhibiting this refresh-header behavior.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026