Threat actors have adopted increasingly sophisticated tactics to evade detection in email phishing campaigns, employing various methods to disguise malware and credential phishing links. A prevalent technique involves embedding customized content in emails, utilizing legitimate file-sharing platforms, abusing open redirects, and incorporating QR codes to lead victims to phishing pages without drawing attention. To evade scrutiny, these actors often leverage legitimate web services to host links to their malicious content instead of hosting malware directly. They typically embed these links into recognized sites like DocuSign, Google Docs, and Canva, as such sites can bypass detection by security email gateways (SEGs) that focus on reputable domains. Additionally, they commonly use open redirects from well-known platforms like Google and YouTube, which do not scan the final redirect URLs, further obscuring their phishing attempts.