PoisonSeedThreat actor
PoisonSeed is a threat actor employing an MFA-resistant phishing kit to acquire credentials from individuals and organizations, primarily targeting email infrastructure for cryptocurrency-related spam. They utilize spear-phishing emails with malicious links, automate bulk downloading of email lists, and capture authentication cookies to bypass MFA.From MISP Galaxy
Last reported 9 days ago, by Silent Push1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“He added, “A vast percentage of social engineering, business email compromise, and credential harvesting attacks leverage lookalike or typo-squatted domains, tracking these external threats serves as a powerful indicator of an organization’s overall cyber hygiene and threat lands…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Silent Push Says Impersonation Monitoring Belongs In Underwriting“The published examples span FIN7, Lazarus, PoisonSeed, FakeUpdate, Keitaro C2, and SecTopRAT.”
Thanks — we review every report.