The Phishing Came From Your Real Domain: What a Marketing Platform Breach Does to Brand Trust

A September 2026 incident where an attacker used compromised access to a third‑party marketing platform to send a phishing email from genuine brand addresses and branding to 347,000 subscribers (affecting 120 platform accounts); 2,500 recipients clicked the malicious link before the phishing domain was taken down within 20 minutes. The report explains that conventional defenses failed because the messages originated from authorised infrastructure, and it recommends treating any service that can send as a high‑privilege third party, enforcing faster vendor notification and takedown paths, self‑suspend capabilities, and active monitoring of messages sent in your name.