PoisonSeed Campaign: Uncovering a Web of Cryptocurrency and Email Provider Attacks

Summary: Silent Push Threat Analysts have identified a sophisticated cyber campaign named “PoisonSeed” targeting enterprise organizations and cryptocurrency holders through phishing and compromised email services. The campaign employs a unique tactic of “crypto seed phrase” phishing attacks to deceive victims into compromising their cryptocurrency wallets. PoisonSeed showcases the complexity of modern cyber threats, with connections to other known groups while maintaining distinct operational characteristics.

Affected: Enterprise organizations, cryptocurrency companies (Coinbase, Ledger), CRM and email service providers (Mailchimp, SendGrid, Hubspot, Mailgun, Zoho)

Keypoints :

• PoisonSeed uses compromised CRM and email providers to facilitate cryptocurrency spam operations.
• The campaign employs “cryptocurrency seed phrase poisoning” to trick victims into revealing their wallet credentials.
• Evidence suggests connections to other threat actors like Scattered Spider and CryptoChameleon, although PoisonSeed is classified distinctly.