Snagged what looks like attempted phish/CSRF
Portrayed itself as a secure banking message. Initial hyperlink directed to
petroleuminvestigations[.]com
Looks like a VPS with openresty doing some lua-based filtering. Then user's kicked to an AWS address impersonating finance documents, and cookies are pulled in from bin.dreatrithoo[.]online common across finance scam sites today per LookyLoo.
34 more domains associated by MX IP address. CSV for all 36:
ThreatLandscape.ai is live Natural language AI copilot for threat intelligence that answers security questions with continuously updated intel, so teams get insights fast without hunting data manually.
Oh well that's fucking clever. A threat actor is sending out phishing emails pretending to be SendGrid, and explaining that all their emails will include "Support ICE" banners in order to trigger ragebait clicks through to the phishing kit.
Back in the saddle with my Cybersecurity Weekly Roundup for 2026.
This week’s signal: CISA moves (KEV + retired Emergency Directives), critical patching for Veeam/Trend Micro/n8n/Cisco ISE, legacy edge gear still getting farmed, “internal-looking” phishing tricks, and malicious browser extensions stealing AI chats.
15 stories, quick briefs, and my practitioner take:
https://www.kylereddoch.me/blog/cybersecurity-weekly-roundup-january-2-9-2026/
#Cybersecurity #InfoSec #VulnManagement #ThreatIntel #Ransomware #BlueTeam #CybersecurityWeeklyRoundup #CybersecKyle
Back in the saddle with my Cybersecurity Weekly Roundup for 2026.
This week’s signal: CISA moves (KEV + retired Emergency Directives), critical patching for Veeam/Trend Micro/n8n/Cisco ISE, legacy edge gear still getting farmed, “internal-looking” phishing tricks, and malicious browser extensions stealing AI chats.
15 stories, quick briefs, and my practitioner take:
https://www.kylereddoch.me/blog/cybersecurity-weekly-roundup-january-2-9-2026/
#Cybersecurity #InfoSec #VulnManagement #ThreatIntel #Ransomware #BlueTeam #CybersecurityWeeklyRoundup #CybersecKyle
More Subjects to search on for that Sendgrid thing mentioned by Ian here.
https://masto.deoan.org/@neurovagrant/115865145438282370
API Authentication Issue
API Endpoint Communication Failed
API Endpoint Disabled
API Endpoint Failure
API Endpoint Issue
API Endpoint Issue
API Error Detected
API Request Failures Detected
API Request Status Update
Action required by January 13
Holiday Email Volume
ICE Support Initiative
Issue with Your API Request
JSON Payload Error
Language Preference Updated
Malformed JSON Payload
Migration to Sinch Authentication
New Pride Template
Pride Month Theme Update
We Couldn't Process Your Request
Your API endpoint has been rate limited
Your request couldn't be completed
More Subjects to search on for that Sendgrid thing mentioned by Ian here.
https://masto.deoan.org/@neurovagrant/115865145438282370
API Authentication Issue
API Endpoint Communication Failed
API Endpoint Disabled
API Endpoint Failure
API Endpoint Issue
API Endpoint Issue
API Error Detected
API Request Failures Detected
API Request Status Update
Action required by January 13
Holiday Email Volume
ICE Support Initiative
Issue with Your API Request
JSON Payload Error
Language Preference Updated
Malformed JSON Payload
Migration to Sinch Authentication
New Pride Template
Pride Month Theme Update
We Couldn't Process Your Request
Your API endpoint has been rate limited
Your request couldn't be completed
So here's the historical pDNS and domain data for sender domains in the headers of these emails from the samples I have.
SendGrid UPNs have been a bust so far, but guessing the attack isn't something to really write home about, but I'd like to see this group in particular inconvenienced for the ragebait aspect.
I hate scumbags like this, but I have to have some respect for decent craft.
So here's the historical pDNS and domain data for sender domains in the headers of these emails from the samples I have.
SendGrid UPNs have been a bust so far, but guessing the attack isn't something to really write home about, but I'd like to see this group in particular inconvenienced for the ragebait aspect.
Huntress writes about VMware exploitation and boy, they have gone all in on the details.
https://www.huntress.com/blog/esxi-vm-escape-exploit
This is well worth reading. Exploit was likely developed almost a year before use. (Or something like that...)
New.
Infoblox: Scaling the Fraud Economy: Pig Butchering as a Service https://www.infoblox.com/blog/threat-intelligence/scaling-the-fraud-economy-pig-butchering-as-a-service/ #infosec #threatintel #threatintelligence #fraud
