• What Is URL Manipulation (URL Rewriting)? How Attackers Hijack Trusted Links to Hide Phishing

What Is URL Manipulation (URL Rewriting)? How Attackers Hijack Trusted Links to Hide Phishing

Blog, Cybersecurity

URL rewriting is meant to protect you from phishing - but attackers have learned to weaponize it. Learn how URL manipulation works, and how to defend against it.

by Ahona Rudra

Last Updated:
9 min read
What Is URL Manipulation (URL Rewriting)? How Attackers Hijack Trusted Links to Hide Phishing

Key Takeaways

  • URL manipulation is a web security attack technique where an attacker alters components of a Uniform Resource Locator (URL) to bypass access controls, view unauthorized pages, or access other users’ data.
  • While security gateways (like Safe Links or Proofpoint) rewrite links to protect users via time-of-click inspection, attackers actively weaponize these trusted vendor wrappers to hide phishing destinations.
  • Modern campaigns (driven by AiTM kits like Tycoon2FA and Sneaky2FA) chain links across three to five security vendors sequentially to evade automated scanners.
  • Attackers use rewritten links in spear-phishing campaigns to trick users into granting malicious OAuth permissions, securing persistent inbox access that survives password resets.
  • A link displaying a security vendor’s domain does not guarantee safety. Security teams must inspect full redirect paths and enforce phishing-resistant MFA.
  • While DMARC doesn’t alter redirect links, enforcing p=reject cuts off the spoofed-domain delivery path attackers rely on to land initial lure emails in target inboxes.

An email lands in your inbox with a link that has already been scanned. You hover over the web address, and it shows a clean domain from a trusted security provider like Microsoft Safe Links. Because your organization’s security tools wrapped and approved the link, you click it without second-guessing. A few seconds later, you find yourself on a convincing login page designed to steal your credentials.

Understanding this threat requires untangling two related concepts: URL manipulation and URL rewriting. URL manipulation is the broad umbrella term for any technique that alters, disguises, or exploits a link to deceive users or security tools. URL rewriting is a specific process under that umbrella.

Defensively, enterprise email security gateways rewrite links inside incoming emails to provide real-time protection. Attackers have figured out how to weaponize this exact mechanism, turning security features into convincing shields for malicious content.

What Is URL Manipulation?

URL manipulation is an umbrella term for any malicious or deceptive technique that alters, disguises, or misuses a Web address to trick a user or bypass automated security filters. Attackers use it to make malicious web destinations look like safe, trusted environments.

Because security professionals use the phrase in several different contexts, it helps to distinguish three distinct scenarios:

  • Defensive URL Rewriting: Security software modifies email links at delivery, wrapping them in a vendor domain to enable real-time checks when clicked.
  • URL Rewriting Abuse: Cybercriminals compromise accounts or chain security vendors together to make dangerous phishing links appear safe.
  • Web Parameter Tampering: A developer-focused attack where an adversary manually edits parameters in a Web browser address bar to bypass authorization controls. The Open Worldwide Application Security Project (OWASP) classifies this as Web Parameter Tampering or Insecure Direct Object Reference (IDOR).

If you want a deeper look at basic link mechanics, read our guide on what is URL phishing. The rest of this article focuses on how adversaries exploit email link-wrapping systems.

URL rewriting is an automated email defense mechanism that replaces original links inside incoming messages with modified URLs pointing to a security vendor’s proxy server. Major security vendors, including Microsoft (Safe Links), Proofpoint (URL Defense), Mimecast, INKY, Sophos, Barracuda, Cisco, Trend Micro, EdgePilot, and Libraesva, use this link-wrapping model to protect enterprise inboxes.

When an email arrives, the security gateway rewrites every web address in the body text. When a recipient clicks the modified link, their browser routes to the vendor gateway first. The gateway inspects the target web page in real time and redirects the browser if the page is safe. If the target is malicious, the gateway blocks access.

What-Is-URL-Rewriting-(and-What-Are-Safe-Links)--

How defensive URL rewriting works: the security gateway checks the destination at the moment of the click, not just at delivery.

This time-of-click inspection exists because cybercriminals frequently change website behavior after delivery. A link can point to a completely benign web page when an email reaches your inbox at 9:00 AM. By 2:00 PM the same link can redirect to a malicious credential-harvesting site instead.

Security provider Barracuda reported that its LinkProtect engine inspects over 10 million click requests weekly. Roughly 1% of scanned links turn out to be malicious at click time rather than send time.

Classic URL Manipulation Techniques

Before examining how attackers weaponize security tools, it is worth covering the classic link manipulation tactics that paved the way.

Punycode and IDN Homograph Attacks

Internationalized Domain Names (IDNs) allow non-ASCII characters in web addresses. Attackers use Punycode encoding to register domains containing foreign characters that look visually identical to Latin letters. An attacker might register a domain replacing a Latin “a” with a Cyrillic “а”. To a reader, the domain looks identical to a genuine brand name, but the browser translates the address to a completely different server.

Typosquatting and Display Text Deception

Typosquatting relies on common typing errors, such as omitted letters, extra hyphens, or swapped top-level domains like .co instead of .com. Attackers often combine typosquatting with HTML display text tricks. An email might display safe text like https://yourbank.com, while the actual HTML href attribute routes the user to a malicious site. You can read more about these tactics in our detailed guide on what is typosquatting.

Layered URL Shorteners and Open Redirects

Adversaries frequently layer multiple URL shorteners on top of each other. Masking the final target behind several short links hides the destination from simple reputation checks. Similarly, attackers abuse open redirects on legitimate web applications. By adding a destination parameter to a trusted domain’s redirect script, the initial link points to a reputable site, but immediately bounces the user to a malicious host.

A related trick abuses how browsers parse credentials embedded in a URL. Everything before an @ symbol is treated as login information, not the destination domain, so a link like https://[email protected] can look like it points to the trusted brand when it actually sends the visitor to malicious-domain.com.

Web Application Parameter Tampering (OWASP)

In web application security, URL manipulation takes a different form. Users manually adjust query parameters or directory structures in their browser address bar to view unauthorized records. While this bug class is critical for web application security, it involves direct browser manipulation rather than email-based social engineering.

How Attackers Are Weaponizing URL Rewriting Itself (2024–2026)

The most concerning development in link security is how adversaries now turn defensive URL rewriting into an evasion technique. Instead of avoiding vendor domain wrappers, threat actors actively seek them out to make malicious messages look legitimate.

The Discovery: Account Compromise and Allowlist Gaps

In mid-2024, security researchers at Perception Point identified campaigns where attackers compromised legitimate Microsoft 365 accounts protected by automated URL rewriting. The attackers sent a benign link from the compromised account to themselves, letting the security tool rewrite the address into a trusted vendor URL. Once they obtained the rewritten wrapper link, they changed the target backend destination to point to a malicious phishing site and distributed the trusted link to target organizations.

This tactic exploits allowlist gaps. Some email security gateways automatically trust links that carry their own domain wrappers. Because the link appears to originate from an internal security provider, downstream filters often skip re-scanning the underlying address.

Documented Campaigns: Double Rewriting and Brand Abuse

Security researchers documented several campaigns abusing link-wrapping infrastructure:

  • Double Rewrite Attack: Researchers documented attacks chaining Proofpoint and INKY rewrites together. The email used a SharePoint lure and a CAPTCHA gate to prevent automated scanners from analyzing the destination page before harvesting user credentials.
  • Mimecast Wrapper Abuse: Attackers routed phishing links through Mimecast’s rewriting infrastructure to obscure destination servers harvesting corporate login credentials.
  • IRS Impersonation: Cybercriminals impersonated the IRS and ID.me using Sophos-rewritten links, using the security vendor’s domain to bypass user scrutiny.

Turning Security Tools Against Victims: OAuth Persistence

Research published by Abnormal Security in late 2024 demonstrated how link manipulation leads to persistent access beyond password theft. Attackers compromised an M365 account and generated a rewritten link through the organization’s email gateway. They used that trusted link in a spear-phishing campaign impersonating an official Microsoft security alert.

When recipients clicked the link, they completed a CAPTCHA and were prompted to grant permissions to a malicious OAuth application. The OAuth token gave attackers persistent access to the victim’s inbox, bypassing future password resets and standard multi-factor authentication checks. This persistence technique is a growing driver of corporate business email compromise.

The 2025–2026 Escalation: Multi-Vendor Redirect Chains

By late 2025 and early 2026, research from LevelBlue SpiderLabs revealed that threat actors had escalated these techniques into multi-vendor redirect chains. Modern phishing-as-a-service platforms, such as Tycoon2FA and Sneaky2FA, construct deep redirect paths that pass through three, four, or five different security vendors sequentially.

These platforms operate as Adversary-in-the-Middle (AiTM) kits. Instead of just capturing static passwords, they proxy live authentication sessions in real time, intercepting session cookies to bypass standard multi-factor authentication (MFA).

LevelBlue SpiderLabs documented a Tycoon2FA campaign featuring a single link exceeding 1,200 characters. The underlying address was routed through five separate vendor domains in sequence: Libraesva → Sophos → INKY → EdgePilot → Barracuda. The lure email itself was framed as a Microsoft document-signing notification. After clearing a CAPTCHA gate designed to filter out automated scanners, victims landed on a fake Microsoft login page built to harvest their credentials.

The-2025–2026-Escalation--Multi-Vendor-Redirect-Chains

The documented Tycoon2FA chain: five trusted vendor domains in sequence before the CAPTCHA gate and fake login page. (Source: LevelBlue SpiderLabs)

Similarly, reports from security aggregators like Paubox, tracking research across TechRadar and GBHackers, noted Sneaky2FA campaigns using three-layer chains (Barracuda → Sophos → Cisco) delivered via HTML attachments. Secondary estimates indicate these campaigns reached tens of thousands of corporate inboxes. These multi-hop chains succeed because many security filters only inspect the first or last domain in a redirect sequence, failing to trace every hop in between.

How to Spot a Manipulated or Suspicious Rewritten URL

End users need simple, practical guidelines to evaluate modified links before clicking. Use this quick inspection checklist:

  • Inspect the complete address: Hover over the link to reveal the full address before clicking. If you want to check a suspicious link safely, test it with a phishing link checker.
  • Watch for excessive nesting: Be cautious of links containing multiple web addresses or repeated URL parameters like url=, redirect=, or target=.
  • Be skeptical of verification prompts: Messages claiming a link was checked or blocked and demanding a manual verification click are common lure designs.
  • Recognize wrapper domain limits: A link displaying a vendor domain like safelinks.protection.outlook.com indicates the message passed through an email security gateway, but it does not guarantee the destination remains safe.

For more basic guidance on evaluating suspicious messages, read our guide on what is a phishing link.

How to Defend Against URL Manipulation Attack Tactics

Defending enterprise networks against multi-layered link manipulation requires combining link inspection updates with strong identity protection and email authentication standards.

  1. Inspect complete redirect paths: Configure email gateways and endpoint security tools to follow every redirect in a link chain. Security scanners must evaluate the final landing page rather than stopping at the initial trusted domain.
  2. Remove implicit trust for wrapper domains: Ensure internal security filters re-scan links even if they carry a domain wrapper from your own email security vendor.
  3. Implement phishing-resistant authentication: Advanced phishing kits like Tycoon2FA intercept session tokens during live logins. Protect your organization by deploying FIDO2 hardware keys, passkeys, or number-matching authentication to mitigate MFA fatigue and session hijacking.
  4. Update security awareness training: Teach staff that wrapped links are not automatic stamps of safety. Train employees to report multi-hop redirects and unexpected credential prompts immediately.
  5. Enforce strict email authentication: Implement Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC across all organizational domains. While DMARC does not stop third-party redirect mechanics, enforcing a p=reject policy stops attackers from spoofing your exact domain name to deliver initial phishing lures. Use a dedicated DMARC Analyzer to monitor sending sources and enforce strict alignment safely.

Conclusion

Defensive URL rewriting remains an important tool for catching time-of-click threats, but attackers have learned to turn that protective layer into a disguise. By chaining multiple security vendor links together, modern Adversary-in-the-Middle campaigns bypass basic filters and trick users into surrendering access.

Protecting your organization requires a multi-layered security approach. Inspect complete redirect paths, deploy phishing-resistant authentication, and close off the spoofed-domain delivery path with automated tools like PowerDMARC’s DMARC Analyzer to keep your inbox delivery environment secure.

Frequently Asked Questions

What is the difference between URL manipulation and URL rewriting?

URL manipulation is the overarching term for altering or disguising links for deceptive purposes. URL rewriting is a specific process where email security tools wrap incoming links inside vendor domains to enable real-time time-of-click inspection before a user reaches the destination.

Microsoft Safe Links provides strong real-time protection, but wrapped links are not completely immune to abuse. Attackers can compromise accounts or build multi-vendor redirect chains to route Safe Links through malicious destinations, meaning users should still inspect suspicious messages carefully.

How do attackers abuse URL rewriting in phishing attacks?

Attackers send links through compromised accounts protected by security vendors to generate wrapped, trusted URLs. They also chain multiple vendor rewrite links together in sequence, confusing automated scanners so they fail to inspect the underlying malicious landing page.

What is punycode (homograph) phishing?

Punycode phishing uses foreign language characters that look identical to standard Latin letters in a domain name. Attackers register these visually identical web addresses to trick users into believing they are visiting a legitimate company website.

Can DMARC stop URL manipulation attacks?

DMARC does not inspect or alter redirect links directly. However, enforcing DMARC with a p=reject policy prevents attackers from spoofing your exact company domain to deliver the initial phishing email, shutting down primary brand impersonation tactics.

What are Tycoon2FA and Sneaky2FA?

Tycoon2FA and Sneaky2FA are sophisticated Adversary-in-the-Middle phishing kits. They intercept user credentials and live session tokens in real time, allowing attackers to bypass standard multi-factor authentication controls even on secure platforms.

CTA

Latest posts by Ahona Rudra (see all)
Last Updated:
Microsoft Account Security Alert Email: How to Spot Scams and Protect Your ...microsoft account security alert email