Most secure email gateways rewrite the links inside a message before it ever reaches an inbox, replacing the original URL with a vendor-branded one that routes through the vendor’s scanning infrastructure first. It is a genuinely useful feature, and it has been standard for years. Researchers at LevelBlue SpiderLabs have spent the back half of 2025 and the first weeks of 2026 documenting how attackers turned that same feature into a delivery mechanism of their own, stacking rewritten links from multiple vendors on top of each other until the resulting chain is long enough, and trusted enough, to walk straight past the defenses that created it.
What URL Rewriting Is Supposed to Do
The logic behind link rewriting is sound. A secure email gateway intercepts an inbound message, replaces every URL in the body with a new one pointing at the vendor’s own domain, and scans the real destination at click time rather than at delivery time, since a link that was clean an hour ago can be weaponized by the time someone actually clicks it. The rewritten link is a promise: this vendor checked where this goes, and checks again every time it is clicked. That promise is exactly what makes it valuable to steal.
Chaining Trust Instead of Breaking It
The technique researchers are now tracking does not attack any single vendor’s rewriting service. It abuses the fact that a link can pass through more than one. An attacker who compromises a mailbox at an organization running one vendor’s gateway can send a malicious link internally, let that gateway rewrite and effectively vouch for it, then take the resulting wrapped link and feed it through a second organization’s gateway, and a third, each one stacking its own trusted domain on top of the last. By the time the link goes out in a mass phishing campaign, it carries the visual and structural credibility of several security brands at once, and no single vendor’s scanner can see past the layer directly in front of it to know what is actually waiting at the end.
LevelBlue’s analysts documented a Tycoon2FA campaign built exactly this way: a document-request lure impersonating Microsoft, carrying a final URL that ran past 1,200 characters after being routed through five consecutive rewriting layers, Libraesva, Sophos, Inky, EdgePilot, and Barracuda, before landing on a compromised website hosting the credential-harvesting page. A separate chain the researchers examined ran six redirects deep across four vendors, Cisco, Trend Micro, Barracuda, and EdgePilot. Neither chain contains a domain that looks suspicious on its own. That is the entire design.
Why This Escalated Through Late 2025
The researchers tracked the shift from single-layer rewriting abuse to deliberately engineered multi-vendor chains escalating through the second, third, and fourth quarters of 2025, peaking in January 2026. The tactic is now a standard feature inside phishing-as-a-service kits including Tycoon2FA and Sneaky2FA, which package adversary-in-the-middle credential and session-cookie theft behind these chains, meaning the technique no longer requires a skilled operator to build. It ships pre-configured to affiliates who buy access to the kit.
Why DMARC Has Nothing to Say Here
DMARC, alongside SPF and DKIM, answers one question: is the domain in the message’s From header authorized to send this message. A phishing email carrying a five-layer rewritten link can fail that check, pass it, or never trigger it at all, and the answer has no bearing on the redirect chain sitting in the message body. Authentication evaluates the envelope. It has no visibility into what a URL does after the message is accepted, and no mechanism for reconstructing a redirect chain built entirely out of domains that are, individually, exactly as trustworthy as they claim to be. This is not a gap in DMARC. It is a category of attack DMARC was never built to see, sitting downstream of every authentication check a receiving server can run.
What This Means for Your Program
Do not assume a rewritten link is a scanned link. A URL wrapped by your own gateway proves that vendor evaluated the next hop in the chain. It says nothing about what is three or four hops further down.
Watch for internally-originated links landing in outbound-looking mail. The technique frequently starts with a compromised mailbox sending a malicious link to itself or a colleague specifically to get it rewritten and trusted before it is reused externally. Unusual internal-to-internal mail carrying links is worth flagging on its own.
Do not rely on a single gateway’s verdict as the final word. If your organization’s mail can pass through more than one filtering layer, treat a clean verdict from one as informative, not conclusive, particularly on messages with unusually long or multiply-encoded URLs.
Keep DMARC enforcement in place, but budget for what it does not cover. A strict p=reject policy still closes the door on domain spoofing. It was never going to close this one, and no configuration change to your DMARC record will.
Train users to be suspicious of link length and redirect count, not just the visible domain. A URL running past a thousand characters through five vendor subdomains is a stronger signal than most brand names in a display name field.
The Takeaway
URL rewriting was built to add a layer of trust between a link and the person who clicks it. Attackers found that trust can be laundered the same way money can, by passing it through enough legitimate hands that its origin stops mattering. DMARC, SPF, and DKIM are still doing their job in every one of these campaigns, confirming or denying who sent the message. That job was never going to extend to what the message links to, and the redirect chain researchers are now finding, five and six layers deep across the biggest names in email security, is proof that the gap between authenticating a sender and vetting a destination is exactly where a well-resourced attacker will go next.
Excello Mail gives you continuous visibility into your DMARC reports, so you can see exactly which sources are authenticating under your domain, even as attackers build their next move around the parts of a message DMARC was never designed to inspect. Sign up for free to Excello Mail and put real monitoring behind the authentication layer you control.