PHISHCEPTION - SENDGRID IS ABUSED TO HOST PHISHING ATTACKS IMPERSONATING ITSELF

Summary from the TLDR InfoSec newsletter

Netcraft has spotted a new phishing campaign that uses compromised SendGrid accounts to phish for new accounts by emailing users that their account had a payment error or other similar issues. The email is sent from a SendGrid account and uses SendGrid’s tracking links to mask the destination. Users are directed to a JsPen link that obfuscates a script tag which loads a JS file from Azure Front Door that is an obfuscated clone of the SendGrid login page.