🎯 Multi-hop redirect chains

The items that name it 2

• We Need to Talk About Device Code Phishing
  article2026-06-22

  Phishing lures (construction RFPs, DocuSign, voicemail notifications) routed through compromised websites, security vendor URL rewriters, and Cloudflare Workers pages to harvest tokens via Railway.com.

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeup2026-03-23It is written here as Multi-hop redirect chains (2-5 hops).

  Use of compromised legitimate websites with real domain reputation as intermediate redirect hops, making single-hop URL inspection uninformative.