NameCheap's email hacked to send Metamask, DHL phishing emails

Re:NameCheap's email hacked to send Metamask, DHL phishing e... by btgeekboy on Sunday February 12, 2023 @09:04PM (#34769354)

If I have a business and I use a company like sendgrid, I have credentials to use that service. If some employee has access to that account (such as to send newsletters), and that employee’s credentials were lost or stolen, that doesn’t seems suspicious at all.

I don’t have any inside info here, but it makes sense. And as a namecheap customer, I see no reason to panic at this time.

[ Parent | on HN ]

Re:NameCheap's email hacked to send Metamask, DHL phishing e... by OJFord on Monday February 13, 2023 @03:43AM (#34771434)

You wouldn't claim 'the issue was with a 3rd party provider' though.

[ Parent | on HN ]

Re:NameCheap's email hacked to send Metamask, DHL phishing e... by citrin_ru on Monday February 13, 2023 @04:40AM (#34771706)

Employees should use 2FA for their accounts and Sendgrid seems to offer this; for password stored in sending applications one can use combination of password and IP ACLs but I don't know if SendGrid allows to set IP ACLs for senders. While 2FA is not a panacea it significantly reduces rick.

One can send newsletters using a subdomain like news.acmecorp.com and have Sendgrid's IPs in SPF record only for this subdomain and not for the main domains (though most recipient would not notice change from say @acmecorp.com to @news.acmecorp.com).

[ Parent | on HN ]