Hackers Targeting HubSpot Users in Targeted Phishing Attack
An active phishing campaign is targeting HubSpot users through a combination of social engineering and infrastructure compromise.
An active phishing campaign is targeting HubSpot users through a combination of social engineering and infrastructure compromise.
The attack employs business email compromise tactics and website hijacking to deliver credential-stealing malware to marketing professionals and business teams using the platform.
The campaign starts with phishing emails that appear to originate from legitimate business accounts. These messages prompt recipients to log into their HubSpot accounts to address an unusual increase in unsubscribes.
The emails utilize MailChimp, a recognized email marketing platform, to distribute the attack at scale, ensuring passage through secure email gateways.
Research indicates that the phishing emails employ a deceptive technique by embedding malicious URLs in the sender's display name rather than in the email body.
This method bypasses many email security controls that typically scan message content but may overlook the sender field.
The emails, combined with a compromised legitimate business domain, appear authentic to both automated systems and human readers.
An active phishing campaign is targeting HubSpot users through a combination of social engineering and infrastructure compromise.
Upon clicking the embedded URL, victims are redirected from a compromised website to a fake HubSpot login portal hosted on Proton66 OOO infrastructure, linked to ASN AS 198953.
When users enter their credentials, the information is captured by attackers.
The phishing mechanism focuses on harvesting valid user credentials instead of delivering traditional malware.
Analysis shows the hosting infrastructure employs a Plesk-managed virtual private server with exposed mail services, including Postfix and Dovecot.
The IP address 193.143.1.220 reveals a wide range of open ports, such as SMTP services on ports 25 and 465, IMAP on ports 143 and 993, and multiple Plesk administrative interfaces.
This setup is indicative of infrastructure designed for rapid deployment and rotation of phishing campaigns.
The IP is associated with multiple phishing attempts, indicating organized attack activity.
The exposed Plesk control panels enable quick deployment of new phishing pages, management of compromised email accounts, and rotation of infrastructure to avoid detection.
Organizations should implement layered security measures that extend beyond standard email authentication protocols to safeguard against evolving threats.
Based on reporting by Cyber Security News.