Phishing campaign uses redirection to bypass security, steal credentials