Security researchers analyzing phishing campaigns throughout 2026 have documented a significant shift in attacker tactics. Redirects now appear in 34% of phishing emails, serving as obfuscation layers that complicate detection and increase credential harvesting success rates. This technique chains multiple URL hops to obscure malicious intent from email gateways and browser security warnings.

Google Workspace deployments face escalating identity-based threats including account compromise, credential abuse, and lateral movement across cloud infrastructure. Without dedicated Identity Threat Detection and Response (ITDR) capabilities, organizations struggle to identify malicious access patterns buried within normal user activity.

The cybersecurity landscape has fundamentally changed. Traditional reactive defense—waiting for alerts, patching vulnerabilities after exploitation, responding to breaches—leaves organizations vulnerable to sophisticated attackers who operate faster than security teams can respond.

Phishing attacks in 2026 increasingly rely on redirect chains to bypass email filters and delay detection. Security researchers analyzing threat data found that 34% of phishing campaigns now incorporate redirects as a core evasion tactic.

Researchers have identified a malicious PowerShell script deployed by DonutLoader that systematically removes advertisements from compromised systems. The attack chain involves sophisticated obfuscation and relies on BinaryNinja for reverse engineering analysis.

Security researchers have identified a malware campaign leveraging DonutLoader to distribute malicious scripts disguised as ad-removal tools. The attack chain uses PowerShell execution to inject payloads into Windows systems, exploiting user trust in legitimate ad-blocking utilities. Analysis reveals the threat targets end users through deceptive packaging and social engineering.