A new cyber campaign known as PoisonSeed is targeting users with cryptocurrency seed phrase scams by hijacking customer relationship management (CRM) platforms and email marketing tools to spread malicious messages.
According to researchers at Silent Push, attackers are using stolen login credentials from CRM services and bulk email providers to distribute spam emails containing fake cryptocurrency recovery phrases. Victims are tricked into copying these seed phrases into new wallets, unknowingly giving attackers full access to their funds.
How the Attack Works
Once attackers gain access to CRM platforms—such as Mailchimp, SendGrid, HubSpot, Mailgun, or Zoho—they use them to send mass phishing emails. The emails urge recipients to create a new Coinbase Wallet using a provided seed phrase, which is actually controlled by the attackers.
After victims import the seed phrase, attackers can access the wallet and drain its funds.
The campaign targets both individuals and enterprise users, not limited to those in the crypto space. Well-known crypto firms like Coinbase and Ledger have also been impersonated in the attacks.
The activity is assessed to be distinct from two loosely aligned threat actors Scattered Spider and CryptoChameleon, which are both part of a broader cybercrime ecosystem called The Com.
Once attackers steal CRM credentials, they create API keys to maintain access even if passwords are changed. Mailing lists are then exported and used to send phishing messages at scale.
Interestingly, the phishing kits used in PoisonSeed differ from those previously associated with Scattered Spider and CryptoChameleon, suggesting this could be a new actor using similar methods.
Related Campaigns
Separately, a Russian-speaking hacker group has been spotted using Cloudflare Pages.Dev and Workers.Dev to host phishing sites. These lure users with fake DMCA takedown notices, tricking them into downloading malware disguised as PDF files.
Once opened, the malware communicates with a Telegram bot, exfiltrates the victim’s IP address, and hands control to Pyramid C2, a command-and-control tool used to manage infected systems.
Comments