PoisonSeed: The Silent Harvest of Trust in Email Supply Chains

The PoisonSeed campaign is a clever and dangerous phishing scheme that’s going after bulk email services like Mailchimp, SendGrid, and HubSpot. By crafting fake login pages that look identical to the real ones, the attackers steal credentials, grab massive email lists, and use them to blast out crypto scam emails. These emails contain “seed phrases” that seem legitimate but if a victim copies them into a wallet, they’re unknowingly handing over control to the attackers. This tactic, known as seed phrase poisoning, gives the hackers access to wallets later, allowing them to drain funds over time.