The Health Supplement That Harvested Credit Cards: How a French-Language Phishing Campaign Weaponized ActiveCampaign

A high-quality, French-language phishing campaign sent via ActiveCampaign targeted a U.S. financial institution CFO with a wellness newsletter that redirected to a live payment-harvesting checkout (credit card, SEPA, PayPal). The message passed initial SPF/DKIM/DMARC checks by leveraging legitimate marketing infrastructure, used professional copy to increase trust, and included multiple domains, URLs, and an ActiveCampaign sending IP as IOCs; IRONSCALES' Adaptive AI detected the malicious URL and quarantined the email before user interaction.