On June 17th 2024, Mimecast’s threat researchers observed a novel URL redirect phishing campaign using Trustpilot. The campaign started abruptly on the June 17th, with investigations determining that this was attributable to Trustpilot URLs, generated by Sendgrid. After review, it was assessed this appears to have been a short-duration mass-volume event seeking to redirect targeted users to a credential harvesting phishing page. The graph below highlights the activity associated with this campaign.
Prior to active use, the technique, along with other styling and distribution characteristics, appears to have been thoroughly tested using compromised user accounts ensuring deliverability. In between the campaign peaks, further testing and validation was observed to maintain successful delivery. The phishing emails were sent primarily through compromised Microsoft 365 and email service provider KDDI. A breakdown of the email service providers utilized is seen below.
Predominantly US focused, Multiple Sectors but significant in Professional, Scientific, and Technical Services
Trustpilot redirects:
Click here to access the full list of Trustpilot redirects
Redirect Hosts:
Click here to access the full list of redirect hosts
TTPs:
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
