A trust proxy is a legitimate service or platform that sits between the victim and the attacker’s final payload, making a malicious path appear safe. In phishing, attackers may route a click through a well-known cloud domain, URL shortener, or other reputable intermediary so the first hop looks benign. The proxy is not necessarily compromised; its reputation is simply being borrowed to reduce user suspicion.
This matters because defenders and users often judge a link by its visible domain instead of the full redirect chain. A trust proxy can hide credential-harvesting pages, malware delivery, or prompts to install remote-access tools behind familiar infrastructure. Effective defenses include inspecting every redirect, reviewing final destination domains, monitoring for unusual download prompts, and blocking unauthorized remote-support software. The key lesson is that trust should be verified at the endpoint, not assumed from the first hop.