The Phishing Kit That Emailed Us Its Own Billing Meter

On 2026-09-04 a targeted document-invite phishing message delivered to a US Midwest grocery CEO contained a pasted, live phishing-as-a-service operator console that exposed subscription metrics (Enterprise plan active, 23 days remaining, 138,291 lifetime sends), a loaded lead list of 4,043, a 25-way concurrency configuration, and a 50-line delivery log showing successful 250 responses; the message aimed at credential harvesting via a staged /sales landing page on a compromised site, evaded most conventional gateway rules and affected one mailbox which was mitigated six seconds after receipt.