Attackers Use Quantum Route Redirect to Launch Instant Phishing on M365

KnowBe4 Threat Labs has uncovered a sophisticated phishing operation dubbed Quantum Route Redirect, described as a turning point in cybercriminal capabilities. The campaign automates credential theft via a pre-configured phishing-as-a-service kit that democratises access for less-skilled actors, with around 1,000 domains currently hosting the tool.

It targets Microsoft 365 by sending emails impersonating DocuSign, payroll departments, payment notifications or HR teams, using an intelligent traffic-routing system to differentiate between security scanners and real users. When security tools scan the links, visitors are silently redirected to legitimate sites, while real users are taken to credential-harvesting pages to steal Microsoft 365 credentials.

The attack relies on browser fingerprinting, VPN/proxy detection and rapid behavioural analysis to defeat multiple layers of protection, and attackers manage campaigns via an admin dashboard that shows real-time analytics. The global reach is extensive, with victims across 90 countries and the United States accounting for 76% of affected users, according to KnowBe4 Threat Labs. Published on 11 November 2025.