Microsoft Customer Voice Phishing Redirect Chains

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•8

Detects emails containing Microsoft Customer Voice URLs that redirect to known cloud-hosting platforms (vercel.app, amplifyapp.com, workers.dev) frequently used for phishing campaigns. This indicates an attempt to leverage legitimate Microsoft services to host or redirect to malicious content.