Bleepingcomputer

Quantum Route Redirect PhaaS Targets Microsoft 365 Users Globally

First seen 11 Nov 2025, 11:18 UTC • Blog.Knowbe4

•81% similarity •34.8

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A phishing automation platform named Quantum Route Redirect has been identified, utilizing around 1,000 domains to steal Microsoft 365 user credentials. Discovered by KnowBe4 in August, this platform allows less skilled cybercriminals to execute phishing attacks with ease, affecting users across 90 countries, predominantly in the U.S.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 9 inferred relationships (STIX 2.1).

Technique (2)

Phishing
T1566 - Phishing

Campaign (1)

Quantum Route Redirect

Malware (2)

Tycoon2FA
VoidProxy

Affected Platform (2)

M365
Microsoft 365

Tool (3)

Docusign
Darcula
Morphing Meerkat

Relationships

Quantum Route Redirect uses Tycoon2FA
Quantum Route Redirect uses VoidProxy
Phishing targets M365
Phishing targets Microsoft 365
T1566 - Phishing targets M365
T1566 - Phishing targets Microsoft 365
Quantum Route Redirect related to Docusign
Quantum Route Redirect related to Darcula
Quantum Route Redirect related to Morphing Meerkat

Community

Browse all →

Tracked Entities in This Story

Tycoon2FA VoidProxy Quantum Route Redirect M365 Microsoft 365

Quantum Route Redirect PhaaS Targets Microsoft 365 Users Globally

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story