URL cloaking is a technique that hides a link’s real destination behind redirects, shortened URLs, scripts, or other misleading link handling. To the user, the visible text or preview may look harmless, while the browser is sent somewhere else after the click.
In cyber security, URL cloaking matters because it helps attackers separate the email or message from the malicious content. Phishing campaigns use it to bypass simple reputation checks, make links look trusted, and delay detection until the victim reaches a fake login page or malware download. Defenders counter it with URL rewriting, time-of-click inspection, browser isolation, and web filtering that follows redirect chains instead of trusting the first URL shown. The key lesson is that the link a person sees is not always the destination the browser reaches.