AT&T-Themed Phishing Campaign Abuses Open Redirect Vulnerability (noSuchEntryRedirect) to Harvest SSN, Credit Card, and CVV Data

AT&T-Themed Phishing Campaign Abuses Open Redirect (TL-2026-1607), also tracked as AT&T Payment Failure Open-Redirect Phishing, is a medium-severity phishing campaign, first published 2026-07-22. It has no confirmed attribution, affects Generic Unnamed third-party website with unvalidated, maps to 14 MITRE ATT&CK techniques (T1036, T1056, T1090), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1607

Threat ID
TL-2026-1607
Also known as
AT&T Payment Failure Open-Redirect Phishing, AT&T Bill Payment Could Not Be Processed Scam
Severity
MEDIUM
Status
ACTIVE
Category
PHISHING
First published
2026-07-22
Last reviewed
2026-07-22
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
telecoms, consumer, financial-services, retail
Target regions
North America, united states of america
Detection rules
9
Indicators of compromise
19

A phishing campaign impersonating AT&T sends fake payment-failure emails threatening 48-hour service disconnection. The lure link abuses a legitimate third-party website's open redirect flaw (via a "noSuchEntryRedirect" parameter that fires on a 404 error) to bounce victims to an attacker-controlled page, evading reputation-based URL scanning before harvesting SSN/EIN, credit card, and CVV data.

How AT&T-Themed Phishing Campaign Abuses Open Redirect works

MailGuard reported an active phishing campaign spoofing "AT&T My Account" as the sender, using an urgency-driven payment-failure notice that threatens service interruption within 48 hours to pressure recipients into clicking an "UPDATE PAYMENT METHOD HERE" button. Rather than linking directly to attacker infrastructure, the email link points to a legitimate, unrelated website's redirect-handling endpoint. That endpoint exposes a "noSuchEntryRedirect" parameter intended to route users somewhere sane after a 404 (page-not-found) condition; the attackers instead engineer the 404 path to be redirected to their own phishing page. Because the initial URL a security scanner or reputation engine sees resolves to a trusted, legitimate domain, this open-redirect abuse defeats domain-reputation and simple URL-scanning defenses that only inspect the link at time of delivery rather than at time of click. The resulting fraudulent page mimics an AT&T billing/payment page and collects full name, billing address, city/state/ZIP, phone number, Social Security Number (or EIN for business accounts), credit card number, expiration date, and CVV. After form submission, the victim is redirected to the genuine AT&T website, a technique intended to suppress victim suspicion and delay campaign discovery/reporting. No CVE, specific malware family, or named threat actor was disclosed in the source reporting; the technique (third-party open-redirect abuse for phishing-link evasion) mirrors a broader 2026 trend documented independently by SANS ISC, Microsoft, and other researchers involving OAuth-redirection and other open-redirect abuse in brand-impersonation phishing.

This campaign also fits a persistent, recurring pattern of AT&T-branded payment/billing phishing observed throughout 2026: a materially similar "Your AT&T bill payment could not be processed" / "Bill Payment Center: Service Disconnection Notification" lure was documented by PCrisk as early as May 2026 (updated again in July 2026), using a phishing page hosted on the no-code site builder domain direct-tv-att-management.framer[.]website and harvesting an identical data set (name, billing address, card number, CVV, expiry, phone). A related but distinct AT&T "rewards points expiring" SMS/smishing campaign observed by Malwarebytes in January 2026 exfiltrated harvested card data via a JSON POST to att.hgfxp[.]cc/api/open/cvvInterface. These are not confirmed to be the same physical infrastructure as the MailGuard-reported noSuchEntryRedirect instance, but they share the same actor TTP profile — free/low-cost no-code web-builder hosting, brand-consistent AT&T page templates, urgency/deadline lures, and direct exfiltration of full card-present-fraud data sets — consistent with recurring, likely PhaaS-adjacent commodity activity rather than a single isolated incident.

MITRE ATT&CK techniques used in TL-2026-1607

Defense Evasion

T1036 Masquerading

Collection

T1056 Input Capture

command-and-control

T1090 Proxy

Execution

T1204 User Execution

Initial Access

T1566 Phishing

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1595 Active Scanning; T1598 Phishing for Information

stealth

T1684.001 Impersonation

Affected products and versions in AT&T-Themed Phishing Campaign Abuses Open Redirect

  • Generic — Unnamed third-party website with unvalidated "noSuchEntryRedirect" error-page redirect parameter
    Vulnerable versions: site-specific redirect handler, not publicly named
    Fixed in: N/A - not publicly disclosed/patched
  • AT&T — AT&T brand / AT&T Wireless customers (impersonation target, not a vulnerable AT&T system)
    Vulnerable versions: N/A
    Fixed in: N/A

Remediation for AT&T-Themed Phishing Campaign Abuses Open Redirect

Patches

  • Patch/harden the abused third-party website's redirect-handling logic so the "noSuchEntryRedirect" (or equivalent 404 handler) parameter validates destinations against an allowlist instead of accepting arbitrary redirect targets

Immediate actions

  • Advise users to navigate to att.com directly rather than clicking links in unsolicited payment-related emails
  • Report and block the observed sender display name "AT&T My Account" / "myAT&T" spoof pattern at the mail gateway
  • Enable time-of-click URL re-scanning (not just delivery-time scanning) in the secure email gateway so redirected destinations are inspected after the open-redirect hop
  • Block/flag the related observed phishing domains direct-tv-att-management.framer.website and att.hgfxp.cc at email/web gateways
  • Audit outbound-facing web applications for unauthenticated redirect parameters (e.g., 404/error-handler redirect params like "noSuchEntryRedirect") that accept attacker-supplied destinations

Workarounds

  • Disable or restrict the vulnerable redirect parameter on the abused web application until it is remediated
  • Configure secure email gateways / SWGs to flag or block known open-redirect abuse patterns (e.g., 404-triggered external redirects) regardless of the front-end domain's reputation

Longer-term hardening

  • Adopt an allowlist-based redirect validation model (reject open redirects; only permit redirects to a fixed set of internal paths) across all customer-facing web applications
  • Deploy brand-impersonation and lookalike-domain monitoring for AT&T-themed lures, including abused no-code website-builder subdomains (Framer and similar platforms)
  • Provide recurring user awareness training on urgency-based payment-failure phishing lures and open-redirect link abuse
  • Instrument web application error/404 handlers with logging and anomaly detection for high-volume or externally-referred redirect parameter abuse

Weaknesses (CWE) in AT&T-Themed Phishing Campaign Abuses Open Redirect

CWE-601

Timeline of AT&T-Themed Phishing Campaign Abuses Open Redirect

  • SANS ISC Q1 2026 analysis of 350+ phishing messages found redirect-based phishing at 32% prevalence in January, establishing the broader technique trend this campaign fits.
  • Malwarebytes documents a related AT&T-branded 'rewards points expiring' smishing campaign exfiltrating harvested card data via JSON POST to att.hgfxp[.]cc/api/open/cvvInterface.
  • DarkReading reports a phishing toolkit using 'smart redirects' to bypass email security scanning, part of the same open-redirect evasion trend.
  • SpecOps Software documents a multi-chain redirect phishing campaign impersonating Cisco, routing victims through legitimate/previously-reputable domains.
  • Microsoft documents an OAuth-redirection abuse phishing campaign targeting government/public-sector organizations, using legitimate authentication redirect logic to bypass email and browser defenses.
  • PCrisk documents an earlier variant of the AT&T 'payment could not be processed' billing phishing email, hosted on direct-tv-att-management.framer[.]website, harvesting the same PII/card data set.
  • PCrisk updates its AT&T payment-failure phishing removal guide, indicating the campaign template remains active in the wild.
  • MailGuard publishes technical analysis of the campaign, describing the open-redirect abuse mechanism and data fields harvested.
  • After form submission, the victim is redirected to the genuine AT&T website to reduce suspicion and delay detection/reporting of the fraud.
  • The fraudulent page, styled as an AT&T payment page, collects name, billing address, city/state/ZIP, phone number, SSN/EIN, credit card number, expiry date, and CVV.
  • Clicking the link sends the victim to a legitimate third-party website's redirect-handling endpoint; the attacker-engineered 'noSuchEntryRedirect' 404 parameter fires and redirects the victim to the attacker-controlled phishing page.
  • Victims receive an email spoofing sender 'AT&T My Account' with a fake payment-failure notice threatening service disconnection within 48 hours and an 'UPDATE PAYMENT METHOD HERE' link.

Sources cited for AT&T-Themed Phishing Campaign Abuses Open Redirect

Threats related to AT&T-Themed Phishing Campaign Abuses Open Redirect

Detection coverage for TL-2026-1607

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1607 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats