Phishing Tool Uses Smart Redirects to Bypass Detection

According to KnowBe4, researchers Jeewang Singh Jalal, Prabhakaran Ravichandhiran and Anand Bodke wrote in a post that the phishing tool Quantum Route Redirect targets Microsoft 365 users and began appearing in the wild around August, with about 1,000 domains hosting the tool. The campaign has compromised victims in 90 countries, illustrating substantial international reach, with most attacks focused in the United States, accounting for 76% of affected users and 24% spread across other regions.

The tool is pitched as a rapid, automation-friendly platform that enables one-click campaign setup and diverse impersonation themes, including Docusign, payroll, and payment notifications, to maximise victim engagement. A key feature is its intelligent redirect system that can bypass protections on Microsoft 365 email deployments, including common layers such as Exchange Online Protection, secure gateways, and cloud email security products, by steering viewers to different end destinations after initial analysis.

The researchers note that KnowBe4 observed Quantum Route Redirect deceiving security tools and potentially allowing attacks to bypass multiple security layers, underscoring the need for robust URL filtering, NLP-enabled analysis, and sandboxing as part of defence.