Unraveling a Phishing Spree That Abuses Email Marketing and Cloud Services

Researchers at Trustwave SpiderLabs have published an analysis showing a rise in phishing campaigns that rely on URL redirectors, compromised domains and abused cloud services to evade detection. The report notes abuse of legitimate email marketing platforms, including a domain—klclick3[.]com—associated with Klaviyo that is used as a click-tracking domain for marketing and transactional emails.

In one campaign, emails with the subject line New Voicemail linked to a phishing page that uses the Chameleon technique, fetching the victim’s company logo to appear authentic. Other cases involve dripemail2[.]com, linked to the Drip Global marketing platform, where the lure impersonated DocuSign and then redirected to a fake Microsoft login portal.

Attackers also host phishing pages on cloud infrastructure such as AWS and Cloudflare, with pages that mimic Roundcube Webmail and employ Cloudflare Turnstile and AJAX to complicate detection. According to the report, threat actors tend to compromise legitimate domains like airswift[.]ae to enhance credibility, and many campaigns use heavily obfuscated JavaScript and CAPTCHA challenges to bypass filters, with victims directed to fake Microsoft login pages to harvest enterprise credentials.