sendgrid

Update: Added HungerRush statement below. Customers of restaurants using the HungerRush point-of-sale (POS) platform say they received emails from a threat actor attempting to extort the company, warning that restaurant and customer data could be exposed if HungerRush fails to respond. HungerRush is a restaurant technology provider that offers point-of-sale (POS), online ordering, delivery management, and payment processing software to help restaurants manage orders, customer information, and business operations. The company claims to work with over 16,000 restaurants, including Sbarro, Jet's Pizza, Fajita Pete's, Hungry Howie's, and many more. Extortion emails sent to restaurant patrons The attacker started sending the emails early Wednesday morning, with multiple recipients sharing samples with BleepingComputer. The first email was sent from [email protected], prompting HungerRush to stop ignoring their extortion emails or it would put customer data at risk. "You cannot ignore all my requests and expect me not to take malicious actions. You still have time," reads the email. "Every restaurant and customer of said restaurants' data which is in the millions is in jeopardy here and I can't even get a response back. Not to worry, there's still time left." A second email, sent three hours later from "[email protected]," escalates the threat, claiming that the attacker has access to data records for millions of customers that contain names, emails, passwords, addresses, phone numbers, dates of birth, and credit card information. BleepingComputer's analysis of the email headers shows they were delivered using Twilio SendGrid, which customers have told BleepingComputer was previously used to send HungerRush restaurant receipts. The emails were sent from o10.e.hungerrush.com (159.183.129.119), which resolves to infrastructure operated by Twilio SendGrid, a platform commonly used by companies to send transactional and marketing emails. The email headers also confirm that the messages passed SPF, DKIM, and DMARC authentication checks for the hungerrush.com domain, as the company's SPF record, shown below, authorizes SendGrid to send emails on their behalf. v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com include:mail.zendesk.com include:_spf.psm.knowbe4.com include:sendgrid.net include:4750273.spf01.hubspotemail.net -all Numerous people on Reddit have reported receiving the emails, stating that past digital receipts from restaurants showed they used HungerRush's ordering or POS systems. Alon Gal, co-founder and CTO of Hudson Rock, posted on LinkedIn that infostealer logs indicate a HungerRush employee's device was allegedly infected with an infostealer in October 2025, leading to the compromise of credentials. According to Gal, the malware stole numerous corporate credentials, including those for the company's NetSuite, QuickBooks-related services, Stripe dashboards, Bill.com vendor payment systems, Visa Online commercial services, and Salesforce environments. After publishing this story, HungerRush said that this previous infostealer infection is not linked to the breach. For the time being, customers of restaurants using the HungerRush POS system should be on alert for potential phishing emails and SMS texts that abuse the potentially stolen information. HungerRush confirms breach HungerRush confirmed to BleepingComputer that they are aware of the incident and have notified law enforcement. "We are aware of the situation and are actively investigating in coordination with the appropriate authorities," HungerRush told BleepingComputer. "Our teams are working quickly to understand the scope, address the issue, and implement any necessary remediation. Protecting our clients and their customers' data is a top priority, and we are treating this matter with the utmost urgency." In a later update, the company says that the incident is not linked to the infostealer infection seen by Alon Gal. Instead, HungerRush says the threat actor used a third-party vendor's compromised credentials to breach its email marketing service account. This allowed the threat actor to gain access to customer contact information, which was used to send the unauthorized emails. "As a result, certain customer contact information (including names, email addresses, mailing addresses, and phone numbers) was accessed and used to send unauthorized email messages to certain merchants and consumers," HungerRush told BleepingComputer in an updated statement. However, HungerRush disputes the threat actor's claims, stating that no sensitive personal or financial information, such as passwords, dates of birth, Social Security numbers, or payment card information, was exposed in the breach. HungerRush also noted that credit card data is not stored within its systems. Furthermore, the company says there is no evidence that any other systems were compromised, with the breach limited to the email marketing service. "As a precautionary measure, HungerRush disabled access to the affected email service to prevent additional unauthorized messages from being sent while the investigation continues," the company said. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The malicious ad tech purveyor known as VexTrio Viper has been observed developing several malicious apps that have been published on Apple and Google's official app storefronts under the guise of seemingly useful applications. These apps masquerade as VPNs, device "monitoring" apps, RAM cleaners, dating services, and spam blockers, DNS threat intelligence firm Infoblox said in an exhaustive analysis shared with The Hacker News. "They released apps under several developer names, including HolaCode, LocoMind, Hugmi, Klover Group, and AlphaScale Media," the company said. "Available in the Google Play and Apple store, these have been downloaded millions of times in aggregate." These fake apps, once installed, deceive users into signing up for subscriptions that are difficult to cancel, flood them with ads, and part with personal information like email addresses. It's worth noting that LocoMind was previously flagged by Cyjax as part of a phishing campaign serving ads that falsely claim their devices have been damaged. One such Android app is Spam Shield block, which purports to be a spam blocker for push notifications but, in reality, charges users several times after convincing them to enroll in a subscription. "Right away it asks for money, and if you don't, the ads are so disruptive that I uninstalled it before I was even able to try it," one user said in a review of the app on the Google Play Store. Another review went: "This app is supposed to be $14.99 a month. During the month of February I have been billed weekly for $14.99 that comes to $70 monthly/$720 a year. NOT WORTH IT. And having problems trying to uninstall it. They tell you one price and then they turn around and charge you something else. They're probably hoping that you won't see it. Or it will be too late to get a refund. All I want is this junk off of my phone." The new findings lay bare the scale of the multinational criminal enterprise that's VexTrio Viper, which includes operating traffic distribution services (TDSes) to redirect massive volumes of internet traffic to scams through their advertising networks since 2015, as well as managing payment processors such as Pay Salsa and email validation tools like DataSnap. "VexTrio and their partners are successful in part because their businesses are obfuscated," the company said. "But a larger part of their success is likely because they stick to fraud, where they know there is less risk of consequences." VexTrio is known for running what's called a commercial affiliate network, serving as an intermediary between malware distributors who have, for example, compromised a collection of WordPress websites with malicious injects (aka publishing affiliates) and threat actors who advertise various fraudulent schemes ranging from sweepstakes to crypto scams (aka advertising affiliates). The TDS is assessed to be created by a shell company called AdsPro Group, with key figures behind the organization from Italy, Belarus, and Russia engaging in fraudulent activity since at least 2004, before expanding their operations to Bulgaria, Moldova, Romania, Estonia, and the Czechia around 2015. In all, over 100 companies and brands have been linked to VexTrio. "Russian organized crime groups began building an empire within ad tech starting in or around 2015," Dr. Renée Burton, VP of Infoblox Threat Intel, told The Hacker News. "VexTrio is a key group within this industry, but there are other groups. All types of cybercrime, from dating scams to investment fraud and information stealers use malicious adtech, and it goes largely unnoticed." But what makes the threat actor notable is that it controls both the publishing and advertising sides of affiliate networks through a vast network of intertwined companies like Teknology, Los Pollos, Taco Loco, and Adtrafico. In May 2024, Los Pollos said it had 200,000 affiliates and over 2 billion unique users every month. The scams, more broadly, play out in this manner: Unsuspecting users who land on a legitimate-but-infected site are routed through a TDS under VexTrio's control, which then leads the users to scam landing pages. This is achieved by means of a smartlink that cloaks the final landing page and hinders analysis. Los Pollos and Adtrafico are both cost-per-action (CPA) networks that allow publishing affiliates to earn a commission when a site visitor performs an intended action. This could be accepting a website notification, providing their personal details, downloading an app, or giving credit card information. It has also been found to be a major spam distributor that reaches out to millions of potential victims, leveraging lookalike domains of popular mail services like SendGrid ("sendgrid[.]rest") and MailGun ("mailgun[.]fun") to facilitate the service. Another significant aspect is the use of cloaking services like IMKLO to disguise the real domains and evaluate criteria like the user's location, their device type, their browser, and then determine the exact nature of content to be delivered. "The security industry, and much of the world, is more focused on malware right now," Burton said. "This is in some sense victim blaming, in which there is a belief that people who fall for scams somehow deserve to be scammed more." "So, stealing your credit card information via malware – even when it requires some ridiculous stroke of keys, like the current fake captcha/ClickFix attacks – is somehow 'worse' than if you are conned into giving it up. Cybersecurity education and greater awareness for treating scams with the same severity as malware are two ways to combat malicious adtech."

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies, including RingCentral, SharePoint, Adobe, and Docusign," Proofpoint said in a Thursday report. The ongoing campaign, first detected in early 2025, is designed to use the OAuth applications as a gateway to obtain unauthorized access to users' Microsoft 365 accounts by means of phishing kits like Tycoon and ODx that are capable of conducting multi-factor authentication (MFA) phishing. The enterprise security company said it observed the approach being used in email campaigns with more than 50 impersonated applications. The attacks begin with phishing emails sent from compromised accounts and aim to trick recipients into clicking on URLs under the pretext of sharing requests for quotes (RFQ) or business contract agreements. Clicking on these links directs the victim to a Microsoft OAuth page for an application named "iLSMART" that asks them to grant it permissions to view their basic profile and maintain continued access to the data that they have been granted access to. What makes this attack notable is the impersonation of ILSMart, a legitimate online marketplace for aviation, marine, and defense industries to buy and sell parts and repair services. "The applications' permissions would provide limited use to an attacker, but it is used for setting up the next stage of the attack," Proofpoint said. Regardless of whether the target accepted or denied the permissions requested, they are first redirected to a CAPTCHA page and then to a phony Microsoft account authentication page once the verification is complete. This fake Microsoft page makes use of adversary-in-the-middle (AitM) phishing techniques powered by the Tycoon Phishing-as-a-Service (PhaaS) platform to harvest the victim's credentials and MFA codes. As recently as last month, Proofpoint said it detected another campaign impersonating Adobe in which the emails are sent via Twilio SendGrid, an email marketing platform, and are engineered with the same goal in mind: To gain user authorization or trigger a cancellation flow that redirects the victim to a phishing page. The campaign represents just a drop in the bucket when compared to overall Tycoon-related activity, with the multiple clusters leveraging the toolkit to perform account takeover attacks. In 2025 alone, attempted account compromises affecting nearly 3,000 user accounts spanning more than 900 Microsoft 365 environments have been observed. "Threat actors are creating increasingly innovative attack chains in an attempt to bypass detections and obtain access to organizations globally," the company said, adding it "anticipates threat actors will increasingly target users’ identity, with AiTM credential phishing becoming the criminal industry standard." As of last month, Microsoft has announced plans to update default settings to improve security by blocking legacy authentication protocols and requiring admin consent for third-party app access. The updates are expected to be completed by August 2025. "This update will have a positive impact on the landscape overall and will hamstring threat actors that use this technique," Proofpoint pointed out. The disclosure follows Microsoft's decision to disable external workbook links to blocked file types by default between October 2025 and July 2026 in an attempt to enhance workbook security. The findings also come as spear-phishing emails bearing purported payment receipts are used to deploy by means of an AutoIt-based injector a piece of .NET malware called VIP Keylogger that can steal sensitive data from compromised hosts, Seqrite said. Over the course of several months, spam campaigns have been spotted concealing installation links to remote desktop software inside PDF files so as to bypass email and malware defenses. The campaign is believed to have been ongoing since November 2024, primarily targeting entities in France, Luxembourg, Belgium, and Germany. "These PDFs are often disguised to look like invoices, contracts, or property listings to enhance credibility and lure victims into clicking the embedded link," WithSecure said. "This design was intended to create the illusion of legitimate content that has been obscured, prompting the victim to install a program. In this case, the program was FleetDeck RMM." Other Remote Monitoring and Management (RMM) tools deployed as part of the activity cluster include Action1, OptiTune, Bluetrait, Syncro, SuperOps, Atera, and ScreenConnect. "Although no post-infection payloads have been observed, the use of RMM tools strongly suggests their role as an initial access vector, potentially enabling further malicious activity," the Finnish company added. "Ransomware operators in particular have favoured this approach."