Hackers Targeting HubSpot Users in Targeted Phishing Attack

An active phishing campaign targets HubSpot users by sending convincing business emails (distributed at scale via MailChimp) that redirect victims from compromised websites to a fake HubSpot login hosted on Proton66 bulletproof infrastructure (ASN AS198953, IP 193.143.1.220). The attackers capture credentials via a login.php endpoint, leverage a Plesk-managed VPS with exposed mail services to rotate pages and manage compromised accounts, and use evasive tactics like embedding malicious URLs in the sender display name to bypass email security controls.