@InfobloxThreatIntel@infosec.exchange
2026-03-25 16:48 UTC
One interesting detail about the Poisonseed phishing campaign is that it appears different targeted users will get different phishing campaigns. There are far fewer examples but ActiveCampaign users have also been targeted on phishing sites like support-activecampaign[.]com
It seems based on the shifts in content the last few months that Poisonseed has seen success with these "Footer template phishing" emails, so this is definitely something to keep an eye on. Some of the Sendgrid phishing domains promoted during these campaigns includes:
usnw1-sgapi[.]com
ussw-sendgrid[.]com
priority-sgportal[.]com
Replies (1)
-
@InfobloxThreatIntel@infosec.exchange 2026-03-25 16:49
There has also been seed phrase poisoning / crypto phishing efforts which have used domains targeting Trezor, Ledger, Coinbase and likely other wallets. Somewhat surprisingly, a recent phishing site actually had a fake blog post from Trezor titled, "Address Poisoning Attacks are Surging – Here's How Your Trezor Now Protects You" which had substantial content likely written by AI, and further links on the page to a phishing portal. writeup-blogtrezor[.]com