The attackers abused Mimecast’s secure-link rewriting feature, using it as a smokescreen to make their links appear safe and authenticated. Because Mimecast Protect is a trusted domain, this technique helps malicious URLs bypass both automated filters and user suspicion.

To boost credibility, the emails copied official service visuals (Microsoft and Office products logos), used service-style headers, footers, and “review Document” buttons, and spoofed display names such as “ X via SharePoint (Online) ”, “ eSignDoc via Y ”, and “ SharePoint ”, closely matching authentic notification patterns.

Related Variant: DocuSign-Style Phishing Using a Different Redirect Method

Alongside the large SharePoint/e-signing campaign, researchers also identified a smaller but related operation that imitates DocuSign notifications. Like the primary attack, it impersonates a trusted SaaS platform and leverages legitimate redirect infrastructure, but the technique used to mask the malicious destination differs significantly.

In the main campaign, the secondary redirect acts as an open redirect, leaving the final phishing URL visible in the query string despite being wrapped in trusted services. In the DocuSign-themed variant, the link moves through a Bitdefender GravityZone URL and then Intercom’s click-tracking service, with the true landing page fully hidden behind a tokenized redirect. This approach conceals the final URL entirely, making the DocuSign variant even more stealthy and harder to detect.

• Image 1: Example of a phishing email CHECK POINT intercepted.

• Image 2: Example of a phishing email from the DocuSign-style variant of the campaign.

The campaign primarily targeted organizations across the U.S., Europe, Canada, APAC, and the Middle East, focusing heavily on consulting, technology, and construction/real estate sectors, with additional victims spanning healthcare, finance, manufacturing, media and marketing, transportation and logistics, energy, education, retail, hospitality and travel, and government. These sectors are attractive targets because they routinely exchange contracts, invoices, and other transactional documents, making file-sharing and e-signature impersonation lures highly convincing and more likely to succeed.

Data from Check Point’s Harmony Email telemetry shows that over 40,000 phishing emails targeting roughly 6,100 customers over the past two weeks. The campaign primarily targeted organizations across the U.S., Europe, Canada, APAC, and the Middle East. By region, the breakdown is as follows:

• USA: 34,057
• Europe: 4,525
• Canada: 767
• Asia: 346
• Australia: 267
• Middle East: 256

Note: Regional distribution reflects where customer data is hosted within our infrastructure and does not necessarily represent customers’ physical locations.

By industry, most affected customers operate in Consulting, Technology, and Construction/Real Estate, with additional representation across Healthcare, Finance, Manufacturing, Media/Marketing, Transportation/Logistics, Energy, Education, Retail, Hospitality/Travel, and Government. These sectors are likely targeted because they frequently exchange contracts, invoices, and other financial documents, making file-sharing and e-signature lures especially convincing.

Now we’ve written about similar phishing campaigns in previous years, but what makes this attack unique is that it shows how easily attackers can imitate trusted file-sharing services to trick users and highlights the need for continued awareness, especially when emails include clickable links, suspicious sender details, or unusual email body content.

Organizations and individuals must also take proactive steps to reduce their risk. A few ways to stay protected include:

1. Always approach links embedded in emails with caution, especially when they appear unexpected or urgent.
2. Pay close attention to email details such as mismatches between the display name and the actual sender address, inconsistencies in formatting, unusual font sizes, low-quality logos or images, and anything that feels out of place.
3. Hover over links before clicking to inspect the real destination and ensure it matches the service that supposedly sent the message.
4. Open the service yourself in the browser and search for the document directly, rather than using links provided in emails.
5. Educate employees and teams regularly about emerging phishing techniques so they understand what suspicious patterns look like.
6. Use security solutions such as email threat detection, anti phishing engines, URL filtering, and user reporting tools to strengthen overall protection.

The attacker campaign described by Check Point exploited legitimate URL redirect services to obfuscate malicious links, not a Mimecast vulnerability. Attackers abused trusted infrastructure – including Mimecast’s URL rewriting service – to mask the true destination of phishing URLs. This is a common tactic where criminals leverage any recognized domain to evade detection.

Mimecast customers are not susceptible to this type of attack.  Mimecast’s detection engines identify and block these attacks. Our URL scanning capabilities automatically detect and block malicious URLs before delivery. After delivery, our URL rewriting service inspects links on click, providing an additional layer that catches threats even when they’re hidden behind legitimate redirect chains.

We continue to enhance our protections against evolving phishing techniques. Customers can review our analysis from 2024 of similar campaigns here: https://www.mimecast.com/threat-intelligence-hub/phishing-campaigns-using-re-written-links/ 

We appreciate Check Point sharing their findings through responsible disclosure.

Source:Advancing Microsoft 365: New capabilities and pricing update