A sophisticated phishing campaign dubbed “PoisonSeed” has emerged targeting customer relationship management (CRM) and bulk email service providers in a concerning supply chain attack. Security researchers have observed the campaign exploiting trusted email channels to bypass traditional security filters and reach potential victims with convincing phishing content. The attack chain begins with the threat actors gaining unauthorized access to bulk email providers like Mailchimp and SendGrid, which are then used to launch secondary phishing campaigns against cryptocurrency holders. By compromising these trusted email delivery platforms, PoisonSeed operators can send fraudulent emails that appear legitimate to recipients and email security tools alike. Organizations utilizing CRM platforms and bulk email services should implement additional verification protocols and conduct thorough security reviews to mitigate potential compromise. Security researchers have noted infrastructure similarities between PoisonSeed and other threat actors associated with “The Comm,” including CryptoChameleon and Scattered Spider. This supply chain methodology represents a sophisticated evolution in phishing tactics, utilizing previously established trust relationships between email service providers and their clients. Examination of the JavaScript from a Ledger wallet phishing page shows how the attackers created a convincing “Upgrade Firmware” interface designed to steal recovery phrases. The operation leverages compromised email infrastructure to distribute malicious content aimed at cryptocurrency wallet holders, particularly Ledger users. The most concerning aspect of this campaign is its focus on capturing cryptocurrency wallet recovery phrases, which can provide attackers with complete access to victims’ digital assets. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Victims are lured through emails that appear to originate from legitimate services, directing them to phishing pages that mimic cryptocurrency platforms. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The phishing page presents users with a textarea input that appears to validate seed phrases using legitimate-looking validation functions.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 04 Apr 2025 14:30:16 +0000