@InfobloxThreatIntel@infosec.exchange
2026-03-25 16:46 UTC
In March 2026 they've also sent multiple phishing emails that claimed a "Women's History Month" footer would be added to all outgoing emails by default, and you merely need to login to disable it...
Replies (1)
-
@InfobloxThreatIntel@infosec.exchange 2026-03-25 16:48
One interesting detail about the Poisonseed phishing campaign is that it appears different targeted users will get different phishing campaigns. There are far fewer examples but ActiveCampaign users have also been targeted on phishing sites like support-activecampaign[.]com It seems based on the shifts in content the last few months that Poisonseed has seen success with these "Footer template phishing" emails, so this is definitely something to keep an eye on. Some of the Sendgrid phishing domains promoted during these campaigns includes: usnw1-sgapi[.]com ussw-sendgrid[.]com priority-sgportal[.]com