Phishing in the Cloud: SendGrid Campaign Exploits Account Security

By: Tej Tulachan, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) has recently observed a new wave of credential harvesting attacks involving phishing emails sent via SendGrid. The campaign exploits the trusted reputation of SendGrid, a legitimate cloud-based email service used by businesses to send transactional and marketing emails. By impersonating SendGrid’s platform, attackers can deliver phishing emails that appear authentic and bypass common email security gateways. The campaign delivers the attack through three differently themed emails, each crafted to create a sense of urgency in both the subject line and body. The emails also use spoofed sender addresses, making them appear as if they genuinely originated from SendGrid.

Figure 1: Email Body

Let’s begin by reviewing the first email, illustrated in Figure 1. The subject line “New Login Location” is designed to grab the user’s attention. At first glance, the email appears legitimate, featuring correctly sized logos and polished formatting. A commonly seen tactic in these phishing emails is mentioning a suspicious login attempt from a fake IP address and location, followed by reassuring language such as “If this was you, no further action is needed” to lower the user’s guard. Furthermore, the threat actor uses an email alias modification spoof to make the email appear as if it originated from SendGrid. Finally, the primary tactic to trick users into revealing their passwords is the malicious link embedded with the prompt “access by clicking this link.” This appeal to human curiosity encourages users to click the link without hesitation.

Figure 2: Email Body

The second phishing email, like the first one, employs spoofing techniques to closely replicate a legitimate message. However, the email body entices users by offering a free promotion to an “Elite Tier” with premium benefits. This tactic plays on users’ emotions—after all, who doesn’t like free perks? At the end of the email, there is an embedded prompt, “Activate Elite Tier Benefits,” which contains a malicious link designed to capture credentials.

Figure 3: Email Body

The final themed phishing email follows a similar pattern to the first, but instead of notifying users about a new login location, it deceives them by claiming their phone number has been changed. This tactic is designed to promote a sense of urgency and panic, prompting users to take immediate action without careful consideration. Like the earlier emails, this email contains an embedded link in “Access Account Settings” directing users to a malicious website designed to steal sensitive information.

Figure 4: Phishing Page

When the button is clicked, the threat actors exploit the open redirect link url6849[.]destinpropertyexpert[.]com/ls/click?. The link structure accepts any URL as a parameter, and the server redirects the user to that specified address. Attackers commonly abuse this behavior to make their phishing links appear more legitimate by leveraging the trust associated with a legitimate domain. It provides an ideal cover for malicious activity, helping threat actors evade detection and bypass security controls by disguising harmful traffic as legitimate. 

These links include encoded data and redirect users to a SendGrid phishing site shown in Figure 4. The landing page appears clean and closely mimics the legitimate SendGrid website, making it difficult to detect at first glance. However, the key takeaway is that the domain hXXps://loginportalsg[.]com is not a legitimate SendGrid website. Users should always verify the URL carefully before interacting with it or taking any action.

This analysis highlights how attackers employ varied techniques to steal user credentials, with each of the three phishing emails crafted differently to achieve the same end goal—harvesting sensitive information. By manipulating trust, creating urgency, and mimicking legitimate platforms, threat actors increase the chances of success. To counter these types of attacks, the PDC helps businesses strengthen their defenses and identify real-world phishing threats—minimizing the risk of data breaches, reputational harm, and business disruption. Schedule a demo today to learn more. 

 
All third-party trademarks referenced by Cofense, whether in logo form, name form, product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of endpoint protections are based on observations at a point in time, based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. Past performance is not indicative of future results.

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog, are registered trademarks or trademarks of Cofense Inc.