When Threat Actors Don’t Have a Viable Email Platform to Phish From, They Just Steal Yours

The report details a phishing campaign dubbed "phishception" in which attackers impersonate SendGrid to hijack SendGrid customer accounts and then leverage the platform's legitimate sending reputation to distribute further phishing; attackers also use JSPen serverless pages to host dynamic phishing content and to probe MFA, increasing success and evasion. The write-up emphasizes user vigilance—scrutinizing sender addresses, email content, and destination URLs—and security awareness training as primary mitigations.