TL;DR

Key Points

• Block known PoisonSeed infra and look-alikes; watch NiceNIC domains spoofing SendGrid/Mailchimp/SSO/crypto.

• Enforce phishing-resistant MFA (FIDO2/WebAuthn) for admins and any account that can send to customers.

• Instrument bulk email/CRM for list-export spikes and unauthorized API keys; alert in near-real time.

• Harden login flows against adversary-in-the-middle (AitM) proxies that steal MFA tokens/session cookies.

• Prioritize crypto-adjacent users (seed phrase = wallet recovery words) and marketing/IT roles for extra controls.

The story in 60 seconds

PoisonSeed is a financially motivated eCrime actor active since March 2025. They hijack bulk email/CRM and spoof login pages to steal credentials at scale, then pivot to cloud and crypto targets. They stand out by pairing supply-chain phish with seed-phrase poisoning and polished AitM kits.

Their kits proxy logins (adversary-in-the-middle) to capture MFA tokens and session cookies, use fake Cloudflare CAPTCHA pages, and automate list exports and API-key creation. Infrastructure churn is fast: NiceNIC registrations, WHOIS obfuscation, crypto/SSO theming.

Impact spans marketing (compromised senders), IT/admins (SSO/cloud), and crypto users (seed-phrase traps). Expect more domains, better spoofing, and continued use of compromised email providers through at least Sep 2025.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Why it matters

SOC

• Three cues: (1) rapid email-list exports or API-key creation in Mailchimp/SendGrid; (2) new domains matching {sendgrid|mailchimp|sso|coinbase|ledger} at NiceNIC or bulletproof hosts; (3) MFA-success followed by impossible travel / device change within minutes.

IR

• Triage: confirm supply-chain pivot (who sent what, from where).

• Preserve: mail/CRM audit logs, API-key creation events, phishing pages/HTML, TLS certs, and session tokens tied to AitM.

SecOps

• Controls: mandate FIDO2 for privileged + bulk-sender roles; conditional access by device key; outbound DNS/TLS SNI blocks for impersonation domains.

Strategic (leadership)

• Customer-trust risk via “legit” campaigns from your accounts; require executive sign-off on FIDO2 rollout and supplier attestations for MFA, logging, and export-rate limits.

See it in your telemetry

Network

• DNS/TLS SNI to newly registered domains resembling {sendgrid|mailchimp|sso|coinbase|ledger}; unusual egress to bulletproof ASNs.

• Short-lived TLS sessions to AitM infra immediately preceding new device/IP cookies for SSO.

Endpoint

Browser launching from email client → external login with redirected chain and new cookies; suspicious certificate chains; clipboard access on wallet pages.

Mail/Gateway

Authenticated sends from your tenant with unusual “From” permutations; sudden rise in bounces/blocks; DKIM/SPF valid but content/links off-brand.

SaaS/IdP

• Mailchimp/SendGrid: spikes in list exports; new API keys; permission grants outside change windows.

• IdP: MFA success + device change + geo shift within one session; step-up prompts bypassed via token replay.

High Impact, Quick Wins

• Ship security keys to the right people first. Start with admins, bulk senders, finance, and any crypto-adjacent user. Sell it: stops AitM where OTP apps cannot. Measure: % FIDO2 coverage on privileged accounts; AitM detections/week.

• Alert on export/API-key abuse now. Add hard thresholds and Just-In-Time approvals for list exports and key creation. Sell it: blocks the monetization step. Measure: MTTR from alert to containment; number of blocked high-risk actions.

• Pre-block look-alike domains. Deploy a curated denylist and pattern rules (registrar + keyword) at DNS/email/firewall. Sell it: reduces click-through and lateral abuse. Measure: block counts; reduction in user-reported phish; hit rate on newly registered look-alikes.

AlphaHunt

Ready to level up your intelligence game?

Sign Up!

Research

Executive Summary

PoisonSeed is a recently identified, financially motivated eCrime actor active since early 2025, targeting enterprise and cryptocurrency sectors through sophisticated credential theft and phishing operations. The group is responsible for high-profile compromises of bulk email providers (Akamai’s SendGrid, Troy Hunt’s Mailchimp), enabling large-scale supply chain phishing attacks. PoisonSeed’s campaigns are characterized by advanced phishing kits capable of pixel-perfect login page spoofing, adversary-in-the-middle (AitM) proxies for MFA bypass, and innovative seed phrase poisoning targeting cryptocurrency wallets.

While PoisonSeed shares some infrastructure and TTPs with groups like Scattered Spider and CryptoChameleon, current research (Silent Push, Troy Hunt, GBHackers) classifies it as a distinct entity due to unique phishing kit codebases and operational behaviors. The group’s infrastructure is notable for rapid domain registration (often via NiceNIC), use of bulletproof hosting, and WHOIS obfuscation. Technical indicators include domains mimicking SendGrid, Mailchimp, Coinbase, and other high-value targets, as well as IPs associated with phishing infrastructure.

PoisonSeed’s attack chain includes supply chain compromise (bulk email/CRM providers), credential harvesting, seed phrase poisoning, and MFA bypass via AitM proxies. The group automates email list exfiltration and API key creation for persistence, and employs fake Cloudflare CAPTCHA interstitials to increase phishing success and evade detection. Targeted sectors include cryptocurrency platforms, enterprise cloud services, financial services, and technology/IT.

Mitigation strategies focus on enforcing phishing-resistant MFA, integrating threat intelligence to block PoisonSeed infrastructure, monitoring for supply chain abuse (e.g., rapid email list exports, unauthorized API key creation), and enhancing user awareness of advanced phishing lures. Organizations should expect PoisonSeed to continue evolving its phishing kits, infrastructure, and social engineering tactics, with a likely increase in targeting of high-value user roles and supply chain vectors over the next 12–24 months. Attribution remains cautious, with high confidence in technical separation from related groups, but moderate confidence in ecosystem overlap.

Historical Context

PoisonSeed is a distinct eCrime threat actor first identified in early 2025, specializing in credential theft and phishing campaigns targeting enterprise and cryptocurrency sectors. The group’s operations have been linked to high-profile incidents involving the compromise of bulk email providers (e.g., SendGrid, Mailchimp) and subsequent supply chain phishing attacks. PoisonSeed’s campaigns are notable for their use of advanced phishing kits, infrastructure reuse, and innovative seed phrase poisoning techniques targeting cryptocurrency wallets. While some TTPs and infrastructure overlap with groups like CryptoChameleon and Scattered Spider, current research classifies PoisonSeed as a separate entity due to unique technical and operational characteristics.

Timeline

• March 2025: PoisonSeed compromises Akamai’s SendGrid account, launching phishing campaigns against enterprise and crypto targets.
• March 2025: Targeted phishing attack against Troy Hunt’s Mailchimp account, leading to rapid email list exfiltration and bulk spam.
• April–September 2025: Ongoing domain registrations, infrastructure expansion, and continued phishing operations targeting CRM, bulk email, and cryptocurrency platforms.

Origin

PoisonSeed is assessed as a financially motivated, Western-based eCrime group. While its infrastructure and some TTPs (e.g., use of NiceNIC registrar, obscene WHOIS fields) show overlap with The Comm collective (which includes Scattered Spider and CryptoChameleon), Silent Push and other primary sources explicitly classify PoisonSeed as a separate actor. There is no direct evidence from CrowdStrike, Google GTI, or CISA linking PoisonSeed as a sub-group or direct affiliate of Scattered Spider or CryptoChameleon, though operational similarities exist.

Countries Targeted

1. United States – Primary focus, especially for enterprise and crypto users.
2. United Kingdom – Targeted via CRM and bulk email provider phishing.
3. Canada – Noted in supply chain and crypto phishing campaigns.
4. Australia – Observed in enterprise and cloud service targeting.
5. European Union – Opportunistic targeting of financial and technology sectors.

Sectors Targeted

1. Cryptocurrency Platforms – Direct targeting of user wallets and seed phrases.
2. Bulk Email/CRM Providers – Initial access for supply chain phishing.
3. Enterprise Cloud Services – Credential harvesting for SSO and cloud accounts.
4. Financial Services – Account takeover and lateral movement.
5. Technology/IT – Infrastructure abuse and phishing infrastructure hosting.

Motivation

PoisonSeed is financially motivated, seeking to steal credentials and seed phrases for direct theft of cryptocurrency and monetization of compromised enterprise accounts. The group leverages compromised infrastructure to scale phishing operations and maximize financial gain.

Attack Types

• Phishing (Credential Harvesting): Pixel-perfect spoofing of login pages for CRM, bulk email, and crypto platforms.
• Seed Phrase Poisoning: Supplying victims with attacker-controlled seed phrases for future wallet compromise.
• MFA Bypass: Adversary-in-the-Middle (AitM) phishing kits intercepting credentials and MFA tokens.
• Supply Chain Attacks: Using compromised email providers to launch further phishing campaigns.
• Infrastructure Abuse: Rapid domain registration, use of bulletproof hosting, and WHOIS obfuscation.

Known Aliases

• PoisonSeed (primary, Silent Push)
• No direct aliases from CrowdStrike, Google GTI, or CISA. Silent Push explicitly distinguishes PoisonSeed from Scattered Spider and CryptoChameleon, despite infrastructure and TTP overlap.

Links to Other APT Groups

• Scattered Spider: Overlap in registrar choice, WHOIS patterns, and some infrastructure, but no direct code or campaign alignment. PoisonSeed is currently being classified separately due to multiple unique data points distinguishing the two and a general lack of code commonalities between the groups.
• CryptoChameleon: Similar targeting of crypto users and infrastructure, but PoisonSeed’s seed phrase poisoning and supply chain spam operations are unique. Alignment on infrastructure decisions is noted, but no current on-page code overlap; groups are kept separate until definitive information is acquired.

Similar Threat Actor Groups

• CryptoChameleon: VIP spear phishing, SIM swaps, and crypto theft, but with different operational tempo and phishing kit design.
• Scattered Spider: Big game hunting, ransomware, and corporate extortion, but not observed using seed phrase poisoning or supply chain spam as in PoisonSeed campaigns.

Breaches Involving This Threat Actor

• Akamai SendGrid Compromise: Used to launch phishing campaigns against Coinbase and other crypto users.
• Mailchimp Account Compromise (Troy Hunt): Led to rapid exfiltration of mailing lists and subsequent phishing.

Technical Indicators (IoCs), Phishing Kit Capabilities, and MFA Bypass Methods

Sample Domains and IPs (from Silent Push):

• active-mailgun[.]com
• barefoots-api[.]com
• cloudflare-sendgrid[.]com
• complete-sendgrid[.]com
• connect1-coinbase[.]com
• firmware-llive[.]com
• firmware-server12[.]com
• hubservices-crm[.]com
• iosjdfsmdkf[.]com
• mailchimp-sso[.]com
• mysrver-chbackend[.]com
• mywallet-cbupgrade[.]com
• nikafk244[.]com
• sso-account[.]com
• support-zoho[.]com
• 212.224.88[.]188
• 86.54.42[.]92

Phishing Kit Capabilities:

• Pixel-perfect spoofing of login pages for SendGrid, Mailchimp, Hubspot, Zoho, Coinbase, and Ledger.
• Use of fake Cloudflare CAPTCHA interstitials to increase legitimacy and evade detection.
• Automated email list exfiltration and API key creation for persistence in compromised accounts.
• Seed phrase poisoning: Supplying attacker-controlled seed phrases to victims for future wallet takeover.

MFA Bypass Methods:

• Adversary-in-the-Middle (AitM) phishing proxies intercepting credentials and MFA tokens.
• Real-time session hijacking and token theft.
• Use of encrypted victim emails in URLs and cookies to validate targets and evade automated scanner.

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Recommendations, Actions and Next Steps

1. Enforce Phishing-Resistant MFA and Strengthen Authentication Controls

   • Mandate phishing-resistant multi-factor authentication (MFA), such as FIDO2/WebAuthn, for all high-value and administrative accounts, especially in cryptocurrency, cloud, and bulk email/CRM environments. Audit for legacy MFA (e.g., OTP via SMS or app) and phase out where possible. Integrate real-time monitoring for Adversary-in-the-Middle (AitM) phishing attempts, including session hijacking and token theft, using SIEM/SOAR platforms.
   • This directly addresses PoisonSeed’s ability to bypass traditional MFA using advanced phishing kits and AitM proxies (Silent Push; Troy Hunt). It reduces the risk of credential and session compromise, especially for accounts with access to sensitive data or bulk email capabilities.
   • Challenges include user adoption, hardware costs for security keys, and integration with legacy systems. A phased rollout and targeted user training are recommended.
   • Metrics: Achieve >90% coverage of phishing-resistant MFA on privileged accounts within 6 months; baseline and target a 50% reduction in successful phishing-related account takeovers within 12 months; monitor and alert on all AitM detection events.
   • MITRE ATT&CK IDs: T1111 (Multi-Factor Authentication Interception), T1556.004 (Adversary-in-the-Middle).

2. Proactively Block and Monitor PoisonSeed Infrastructure and Supply Chain Abuse

   • Integrate threat intelligence feeds to automatically block known PoisonSeed domains, IPs, and IoCs at the network perimeter, email gateways, and endpoint security solutions. Use domain monitoring tools to detect and block new registrations matching PoisonSeed patterns (e.g., NiceNIC registrar, SendGrid/SSO/crypto references). Implement SIEM rules to alert on rapid email list exports, unauthorized API key creation, and anomalous account activity in bulk email/CRM platforms.
   • This disrupts PoisonSeed’s ability to deliver phishing payloads, exfiltrate data, and abuse compromised infrastructure for supply chain attacks (Silent Push; Bleeping Computer).
   • Considerations: Requires continuous threat intelligence updates, tuning to minimize false positives, and close coordination with IT/security operations.
   • Metrics: Block 100% of known PoisonSeed IoCs within 24 hours of publication; alert on all rapid email list exports and unauthorized API key events; measure time-to-detection for new PoisonSeed domains and target <48 hours.
   • MITRE ATT&CK IDs: T1583.001 (Acquire Infrastructure: Domains), T1566.001 (Phishing: Spearphishing Attachment), T1584.001 (Compromise Infrastructure: Domains).

3. Enhance User Awareness and Audit Controls for Bulk Email/CRM and Crypto Platforms

   • Launch targeted security awareness campaigns to educate users on identifying sophisticated phishing lures, fake CAPTCHA interstitials, and seed phrase poisoning. Implement granular audit controls and automated alerting for bulk email/CRM and crypto platforms, including monitoring for rapid data exports, unauthorized API key creation, and anomalous login activity. Enforce regular credential rotation and least-privilege access for sensitive accounts.
   • This mitigates the risk of user-driven compromise and supply chain abuse, directly countering PoisonSeed’s tactics of leveraging compromised email/CRM accounts and seed phrase poisoning (Troy Hunt; Bleeping Computer).
   • Challenges: Maintaining user engagement, balancing security with usability, and ensuring audit coverage across diverse platforms.
   • Metrics: Achieve >80% user participation in phishing simulation and awareness training; 100% coverage of audit logging for sensitive actions; alert on all anomalous export/API key events; target a 50% reduction in user-initiated security incidents over 12 months.
   • MITRE ATT&CK IDs: T1086 (PowerShell for automation), T1078 (Valid Accounts), T1110 (Brute Force), T1192 (Spearphishing Link).

Attribution and Evidence Note:
Current research (per Silent Push and corroborated by Troy Hunt and Bleeping Computer) treats PoisonSeed as a distinct entity, despite infrastructure and TTP overlap with Scattered Spider and CryptoChameleon. There is no direct code or campaign alignment, and attribution should remain cautious and evidence-based.

Areas of Uncertainty and Confidence Assessment:

• Attribution to Scattered Spider and CryptoChameleon is not confirmed by primary sources (CrowdStrike, Google GTI); current classification is based on infrastructure and TTP overlap, but Silent Push and other researchers treat PoisonSeed as a distinct group. Confidence: High for technical separation, Moderate for ecosystem overlap.
• No direct CISA or government advisories as of September 2025. Confidence: High.
• Technical IoCs and phishing kit details are well-documented in primary research. Confidence: High.

Suggested Pivots

1. What are the specific technical and operational differences in the phishing kits and infrastructure used by PoisonSeed compared to closely related groups like Scattered Spider and CryptoChameleon, and how can these differences be leveraged for more precise attribution and detection?

2. How effective are current phishing-resistant MFA solutions (e.g., FIDO2/WebAuthn) against PoisonSeed’s adversary-in-the-middle (AitM) phishing techniques, specifically regarding session hijacking, token interception, and user adoption challenges, and what additional security controls or detection mechanisms can be developed to mitigate these advanced MFA bypass methods?

3. What are the key indicators and behavioral patterns of PoisonSeed’s supply chain phishing attacks on bulk email and CRM providers, including domain registration patterns, rapid email list exports, and unauthorized API key creation, and how can organizations proactively monitor and disrupt these campaigns to prevent large-scale credential theft and seed phrase poisoning?

Forecast

Short-Term Forecast (3-6 months)

PoisonSeed will intensify targeted phishing campaigns focusing on high-value user roles within enterprise and cryptocurrency sectors. Marketing teams, IT administrators, and high-net-worth cryptocurrency holders are at elevated risk due to their access to bulk email platforms, CRM systems, and crypto wallets. The group will continue exploiting compromised bulk email providers (e.g., SendGrid, Mailchimp) to conduct supply chain phishing, rapidly exporting email lists and creating API keys for persistence and spam dissemination. Their advanced phishing kits will maintain use of adversary-in-the-middle (AitM) proxies to bypass traditional MFA, including OTP and app-based tokens, with a strong emphasis on phishing-resistant MFA evasion. The use of fake Cloudflare CAPTCHA interstitials will persist as a social engineering tactic to increase victim trust and evade automated detection. Organizations should expect PoisonSeed to register numerous new domains via NiceNIC registrar, often embedding SendGrid, SSO, or crypto-related keywords, to expand their phishing infrastructure. The seed phrase poisoning technique will be refined to increase victim conversion rates, targeting users transitioning to self-custodial wallets, as seen in recent Coinbase phishing campaigns.

Examples

• The March 2025 Akamai SendGrid compromise enabled PoisonSeed to send phishing emails that passed SPF, DKIM, and DMARC checks, increasing delivery success.
• Troy Hunt’s Mailchimp account compromise demonstrated rapid, automated email list export and API key creation for persistence.
• Use of fake Cloudflare CAPTCHA interstitials to simulate legitimate security checks before credential harvesting.
• Precision-validated phishing embedding encrypted victim emails in URLs and cookies to evade automated scanners and validate targets.
• Newly identified domains such as https-loginsg[.]com and sgaccountsettings[.]com registered via NiceNIC with hosting on bulletproof providers.

What to Watch Out For

• Detection of new domain registrations with NiceNIC registrar containing SendGrid, SSO, or crypto references.
• Alerts on rapid email list exports and unauthorized API key creation in bulk email and CRM platforms.
• Increased incidents of MFA bypass involving AitM phishing kits, especially targeting OTP and app-based MFA.
• Reports of seed phrase poisoning phishing emails targeting cryptocurrency users transitioning to self-custodial wallets.
• Emergence of phishing emails with fake CAPTCHA interstitials or Cloudflare challenge impersonations.

Long-Term Forecast (12-24 months)

PoisonSeed is likely to evolve into a more sophisticated and persistent threat actor, potentially expanding its operational scope beyond current targets to include financial services and technology sectors with high-value cloud and SaaS environments. The group may adopt or develop novel MFA bypass techniques, possibly leveraging emerging authentication technologies or zero-day vulnerabilities, though this remains speculative and should be monitored with caution. Regulatory trends in the US and EU, such as increased mandates for phishing-resistant MFA adoption and supply chain security requirements, may pressure PoisonSeed to innovate or shift tactics, possibly increasing use of social engineering and supply chain compromises in less regulated regions. Attribution will remain complex due to infrastructure and TTP overlaps with The Comm collective groups like Scattered Spider and CryptoChameleon; however, primary sources (Silent Push, Troy Hunt) maintain PoisonSeed as a distinct entity based on unique phishing kit codebases and operational behaviors. Organizations should prepare for PoisonSeed’s potential collaboration or personnel overlap with related groups, necessitating enhanced threat intelligence sharing and zero-trust security architectures.

Examples

• Scattered Spider’s evolution from phishing to ransomware and corporate extortion illustrates potential escalation paths for PoisonSeed.
• Increasing adoption of phishing-resistant MFA (FIDO2/WebAuthn) in regulated sectors may drive PoisonSeed to develop advanced bypass or social engineering methods.
• Supply chain attacks expanding from bulk email providers to cloud service providers and software vendors, as seen in other eCrime campaigns.
• Regulatory initiatives like the US Executive Order on Improving the Nation’s Cybersecurity and EU NIS2 Directive emphasizing supply chain security and MFA.
• Historical cases where threat actors splintered or collaborated within fluid cybercriminal communities, complicating attribution.

What to Watch Out For

• Emergence of PoisonSeed-linked campaigns targeting new supply chain vectors beyond bulk email providers.
• Reports of successful phishing-resistant MFA bypasses involving novel techniques or zero-day exploits.
• Increased infrastructure sophistication, including bulletproof hosting, domain shadowing, and encrypted command and control.
• Evidence of operational collaboration or shared infrastructure with Scattered Spider, CryptoChameleon, or other The Comm collective members.
• Changes in targeting patterns aligned with regulatory shifts or technological adoption in MFA and supply chain security.

Appendix

References

1. (2025-04-03) - PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
2. (2025-09-11) - PoisonSeed Threat Actor Strengthens Credential Theft Operations with New Domains (GBHackers)
3. (2025-09-11) - PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)
4. (2025-03-25) - A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)
5. (2025-03-14) - Coinbase phishing email tricks users with fake wallet migration (Bleeping Computer)

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe! • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

MITRE ATT&CK

Techniques

1. T1566.002 (Phishing: Spearphishing Link) – PoisonSeed conducts highly targeted spearphishing campaigns using links to spoofed login pages for CRM, bulk email, and cryptocurrency platforms. Silent Push and GBHackers detail the use of pixel-perfect phishing sites and supply chain phishing via compromised email providers.

   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)

2. T1557.003 (Adversary-in-the-Middle: Web Session Cookie) – PoisonSeed’s phishing kit uses adversary-in-the-middle (AitM) proxies to intercept credentials and session cookies, enabling MFA bypass and real-time session hijacking. This is described in GBHackers and Silent Push.

   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

3. T1111 (Multi-Factor Authentication Interception) – PoisonSeed’s AitM phishing kit is designed to intercept MFA tokens, including SMS and app-based codes, as described in GBHackers and corroborated by Troy Hunt’s analysis of the Mailchimp compromise.

   • A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)
   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)

Tactics

1. TA0001 (Initial Access) – PoisonSeed gains initial access through phishing, supply chain compromise, and credential harvesting, as detailed in Silent Push and Bleeping Computer.

   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
   • Coinbase phishing email tricks users with fake wallet migration (Bleeping Computer)

2. TA0006 (Credential Access) – The group’s primary objective is to steal credentials and seed phrases for financial gain, as described in Silent Push and GBHackers.

   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)

3. TA0005 (Defense Evasion) – PoisonSeed uses fake CAPTCHA interstitials, WHOIS obfuscation, and infrastructure reuse to evade detection, as described in GBHackers and Silent Push.

   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

Procedures

1. T1566.002 (Phishing: Spearphishing Link) – PoisonSeed sends emails with links to spoofed login pages for SendGrid, Mailchimp, Hubspot, Zoho, Coinbase, and Ledger, harvesting credentials and seed phrases. This is detailed in Silent Push and Troy Hunt.

   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
   • A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)

2. T1557.003 (Adversary-in-the-Middle: Web Session Cookie) – The phishing kit acts as a proxy, capturing credentials and MFA tokens, enabling real-time session hijacking and unauthorized access, as described in GBHackers.

   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)

3. T1078 (Valid Accounts) – PoisonSeed leverages compromised credentials to access bulk email, CRM, and cloud accounts for persistence and further attacks, as described in Troy Hunt and Silent Push.

   • A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

Software

1. S0684 (Evilginx) – PoisonSeed’s phishing kit capabilities and AitM techniques closely resemble those of Evilginx, a well-known adversary-in-the-middle phishing framework. While there is no direct evidence PoisonSeed uses Evilginx, multiple sources (GBHackers, Silent Push) note the similarity in AitM proxy behavior and session hijacking.
   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

Mitigations

1. M1032 (Multi-factor Authentication) – Enforce phishing-resistant MFA (e.g., FIDO2/WebAuthn) to reduce the risk of credential and session compromise. This is recommended by GBHackers and Silent Push.

   • PoisonSeed Phishing Kit Bypasses MFA to Steal Credentials (GBHackers)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

2. M1017 (User Training) – Conduct targeted security awareness campaigns to educate users on identifying phishing lures, fake CAPTCHA interstitials, and seed phrase poisoning, as recommended by Troy Hunt and Silent Push.

   • A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)
   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)

3. M1041 (Network Intrusion Prevention) – Integrate threat intelligence feeds to block known PoisonSeed domains, IPs, and IoCs at the network perimeter and email gateways, as recommended by Silent Push and Bleeping Computer.

   • PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
   • Coinbase phishing email tricks users with fake wallet migration (Bleeping Computer)

Groups

PoisonSeed is not currently tracked as a distinct group in the MITRE ATT&CK framework. Silent Push and other sources explicitly distinguish PoisonSeed from Scattered Spider (G0139) and CryptoChameleon, noting infrastructure and TTP overlap but no direct code or campaign alignment.

• PoisonSeed Campaign Targets CRM and Bulk Email Providers (Silent Push)
• A Sneaky Phish Just Grabbed my Mailchimp Mailing List (Troy Hunt)