Attackers Abuse HubSpot’s Free Form Builder to Craft Phishing Pages

#### Executive summary: Palo Alto Networks Unit 42 identified a large-scale credential-harvesting phishing campaign targeting at least 20,000 users at European companies (automotive, chemical, industrial), using DocuSign-enabled PDFs and malicious HubSpot Free Form Builder links to steal credentials and take over Microsoft Azure accounts; attackers leveraged VPNs and bulletproof VPS hosting and reused infrastructure across operations, and HubSpot was not compromised during the campaign.