Open Redirect Flaws: The Newest Phishing Trick

Open Redirect Flaws Phishing TacticNo surprise: phishing attacks are on the rise, and an old technique is now--again--getting increasingly popular: open redirect flaws. These flaws allow attackers to redirect victims to malicious websites, even if the link in the phishing email appears to be legitimate.

How do open redirect flaws work?

Open redirect flaws occur when a website permits users to input their own URLs into a redirect link. If the website does not validate or sanitize these inputs properly, attackers can use the flaw to redirect victims to malicious websites. For instance, attackers may send phishing emails that contain a link to a legitimate website, such as However, the link could actually redirect recipients to a malicious site that resembles the real Bank of America site.

To protect yourself from open redirect attacks, follow these steps:

  1. Be cautious of links in emails from unknown senders.
  2. Don't click on links in emails with typos or grammatical errors.
  3. Hover over the links in emails to see the actual URL before clicking on them.
  4. Use a security solution that can detect and block open redirect links.

Organizations can also take measures to protect themselves from these types of attacks, such as providing security awareness training for employees on how to identify social engineering and phishing emails. 

Here are some additional tips for recognizing open redirect flaws in phishing emails:

  1. Look for a URL shortener service. Attackers often use URL shorteners to conceal malicious links in phishing emails.
  2. Always examine the URL of the link carefully. If it contains strange characters or parameters, it is best not to click on it.
  3. Hover over the link before clicking on it. This will allow you to verify that the link points to the website it claims to be rather than malicious content.
  4. When in doubt, it's always best to be cautious and avoid clicking on it.

By educating employees on open redirect flaws and paying close attention to the links in emails, you can reduce the risk of becoming a victim of these flaws in phishing attacks.

New-school security awareness training can enable employees to follow security best practices and avoid falling for phishing and social engineering traps.

HelpNet Security has the full story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews