The Mimecast Threat Research team has identified a new sextortion scam campaign leveraging legitimate invoicing services to distribute malicious emails. These campaigns, which began in June 2025, utilise evasion techniques to bypass security solutions and target unsuspecting recipients. The campaigns are notable for their use of legitimate services to lend credibility to their malicious intent.
Campaign Details
Recent phishing campaigns have been identified utilising Eslip, Snap Invoicing, and Loyverse for distribution. These platforms, which provide invoicing and payment processing services, are being exploited to facilitate automated scams. The campaigns exploit the functionality of established invoicing services, allowing attackers to send fraudulent email notifications that appear legitimate. This tactic not only enhances the credibility of the scams but also increases the likelihood of user engagement.
Three similar campaigns have been identified, both using the same Bitcoin wallet address for payment and email reply-to address, indicating a coordinated effort. The emails claim to have compromising material on the recipient and demand payment in Bitcoin to prevent the release of this material. Other personal information is used such as date of birth or password of recipient to give further legitimacy and cause panic. This points to the recipient’s information being in a data breach, and how this type of data can be leveraged for onwards attacks.
Evasion Techniques
To bypass security solutions, the attackers employ the following methods:
- Splitting the Bitcoin address into two parts within the email to avoid detection by automated scanners.
- Hosting additional extortion details, including the Bitcoin address, on an external hosting site (catbox.moe). This ensures that sensitive details are not directly included in the email body, further evading detection.
Recent campaigns reveal a strategic shift among threat actors toward the abuse of legitimate online notification services as delivery vectors. This tactic leverages the inherent trust users place in well-known platforms to bypass perimeter defences and evade standard security controls. The exploitation of these trusted services not only increases the likelihood of user interaction but also reduces the chances of detection, presenting a heightened risk to enterprise environments. These developments reinforce the need for adaptive detection strategies that account for abuse of legitimate infrastructure.
Mimecast Protection
Mimecast has implemented detection capabilities to identify and block emails associated with this campaign. We continue to monitor for changes in tactics and techniques used by the threat actors to ensure our customers remain protected.
Targets:
Predominantly US and Australian organisations across various industries
IOC's
Sending Email Addresses
mailer@snapinvoicing[.]com
help@loyverse[.]com
Reply-to Address
contact@enrolledagent[.]com
Subjects
[name] – We Got You! [name] – Immediate Action Required Quote# [six digit number] from BlackEye for [name]
Bitcoin Wallet
1AiSyds8XSXEVCs4QWhdpsbikCEiLfpWLY
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
