# AT&T-Themed Phishing Campaign Abuses Open Redirect Vulnerability (noSuchEntryRedirect) to Harvest SSN, Credit Card, and CVV Data

> A phishing campaign impersonating AT&T sends fake payment-failure emails threatening 48-hour service disconnection. The lure link abuses a legitimate third-party website's open redirect flaw (via a "noSuchEntryRedirect" parameter that fires on a 404 error) to bounce victims to an attacker-controlled page, evading reputation-based URL scanning before harvesting SSN/EIN, credit card, and CVV data.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1607
- **ID:** TL-2026-1607
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MailGuard reported an active phishing campaign spoofing "AT&T My Account" as the sender, using an urgency-driven payment-failure notice that threatens service interruption within 48 hours to pressure recipients into clicking an "UPDATE PAYMENT METHOD HERE" button. Rather than linking directly to attacker infrastructure, the email link points to a legitimate, unrelated website's redirect-handling endpoint. That endpoint exposes a "noSuchEntryRedirect" parameter intended to route users somewhere sane after a 404 (page-not-found) condition; the attackers instead engineer the 404 path to be redirected to their own phishing page. Because the initial URL a security scanner or reputation engine sees resolves to a trusted, legitimate domain, this open-redirect abuse defeats domain-reputation and simple URL-scanning defenses that only inspect the link at time of delivery rather than at time of click. The resulting fraudulent page mimics an AT&T billing/payment page and collects full name, billing address, city/state/ZIP, phone number, Social Security Number (or EIN for business accounts), credit card number, expiration date, and CVV. After form submission, the victim is redirected to the genuine AT&T website, a technique intended to suppress victim suspicion and delay campaign discovery/reporting. No CVE, specific malware family, or named threat actor was disclosed in the source reporting; the technique (third-party open-redirect abuse for phishing-link evasion) mirrors a broader 2026 trend documented independently by SANS ISC, Microsoft, and other researchers involving OAuth-redirection and other open-redirect abuse in brand-impersonation phishing.

This campaign also fits a persistent, recurring pattern of AT&T-branded payment/billing phishing observed throughout 2026: a materially similar "Your AT&T bill payment could not be processed" / "Bill Payment Center: Service Disconnection Notification" lure was documented by PCrisk as early as May 2026 (updated again in July 2026), using a phishing page hosted on the no-code site builder domain direct-tv-att-management.framer[.]website and harvesting an identical data set (name, billing address, card number, CVV, expiry, phone). A related but distinct AT&T "rewards points expiring" SMS/smishing campaign observed by Malwarebytes in January 2026 exfiltrated harvested card data via a JSON POST to att.hgfxp[.]cc/api/open/cvvInterface. These are not confirmed to be the same physical infrastructure as the MailGuard-reported noSuchEntryRedirect instance, but they share the same actor TTP profile — free/low-cost no-code web-builder hosting, brand-consistent AT&T page templates, urgency/deadline lures, and direct exfiltration of full card-present-fraud data sets — consistent with recurring, likely PhaaS-adjacent commodity activity rather than a single isolated incident.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1586 Compromise Accounts
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1090 Proxy
- T1684.001 Impersonation
- T1056 Input Capture
- T1567 Exfiltration Over Web Service

## Sources

- [AT&T Phishing Campaign Exploits Website Redirect Vulnerability](https://www.mailguard.com.au/blog/att-phishing-campaign-exploits-website-redirect-vulnerability)
- [AT&T Payment Could Not Be Processed Email Scam - Removal and recovery steps](https://www.pcrisk.com/removal-guides/35311-atat-payment-could-not-be-processed-email-scam)
- [Watch out for AT&T rewards phishing text that wants your personal details](https://www.malwarebytes.com/blog/threat-intel/2026/01/watch-out-for-att-rewards-phishing-text-that-wants-your-personal-details)
- [AT&T Scam Text & How to Avoid it 2026](https://blog.incogni.com/att-text-scam/)
- [How often are redirects used in phishing in 2026?](https://isc.sans.edu/diary/32870)
- [Microsoft: Beware Phishing Attacks with Open Redirect Links](https://www.govinfosecurity.com/microsoft-beware-phishing-attacks-open-redirect-links-a-17404)
- [Threat actors weaponize OAuth redirection logic to deliver malware](https://www.helpnetsecurity.com/2026/03/03/attackers-abusing-oauth-redirection-phishing-malware/)
- [OAuth redirection abuse enables phishing and malware delivery](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/)
- [New Phishing Campaign Exploits Cisco Domains](https://specopssoft.com/blog/phishing-campaign-cisco/)
- [Phishing Tool Uses Smart Redirects to Bypass Detection](https://www.darkreading.com/endpoint-security/phishing-tool-smart-redirects-bypass-email-security)
- [CWE-601: URL Redirection to Untrusted Site ('Open Redirect')](https://cwe.mitre.org/data/definitions/601.html)
- [Protect Yourself from Phishing and Fake Websites - AT&T Customer Support](https://www.att.com/support/article/my-account/KM1010136/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1607