HubSpot users targeted by active phishing campaign

Evalian SOC has identified an active phishing campaign targeting HubSpot customers. The campaign uses a business email compromise (BEC) and website compromise to deliver a sophisticated credential stealer to end users.

In this blog, we explain how the attack was delivered, how it evaded detection, and how our SOC identified the underlying infrastructure.

The HubSpot logo is shown solely to identify the company in this analysis of a phishing campaign. Evalian is not sponsored by or affiliated with HubSpot.

Figure 1: Phishing Email

How the spoofed Hubspot email bypassed email security controls

The spoofed email urges users to log in to their HubSpot account to review their marketing campaign because of an increased number of unsubscribes detected. Interestingly, the URLs within the email were not malicious, but the attacker had inserted a phishing URL in the sender’s display name, as shown in the image above. This may be an attempt to bypass email security controls because the sender’s display name is not usually checked for malicious URLs.

Alongside this, the attackers used a business email compromise attack to take control of a legitimate email address and then used MailChimp (an email marketing platform) to distribute the attack en masse.

These techniques, when used together, allowed the email to bypass secure email gateways (SEGs) due to their trusted reputation.

Compromised website used to deliver a credential stealer

The malicious URL indicates that a legitimate website (canvthis[.]com) has been compromised, redirecting the user to a credential stealer at hxxps://hubspot-campaigns[.]com/login. Investigating this URL within a sandbox browser shows a convincing login page that mimics the legitimate HubSpot login portal.

Figure 2: Malicious HubSpot Login Page

Entering fake credentials and investigating the POST requests shows that the login information is sent to a login.php file. The IP address the stealer is hosted on relates to Proton66 OOO with ASN AS 198953. Public reporting ties this ISP to a Russian bulletproof hosting service, which multiple attackers abuse to perform similar attacks.

Figure 3: POST Information

Figure 4: IP OSINT Reports

OSINT on this IP shows it linking to multiple other attempted phishing campaigns.

IP Analysis

Analysis on the IP 193[.]143[.]1[.]220 confirmed with a high level of confidence that it is used in phishing infrastructure hosted in Russia (Saint Petersburg) on AS198953 (Proton66 OOO), an ASN frequently associated with spam and phishing activity.

The host uses a Plesk-managed VPS with an auto-generated hostname (*.plesk[.]page), exposing a full mail stack (Postfix + Dovecot) alongside publicly accessible Plesk admin panels. This setup is commonly abused for short-lived phishing campaigns.

Key indicators include:

• Disposable plesk.page subdomain with no legitimate brand identity
• Exposed SMTP, IMAP, and submission services using legacy authentication methods
• Self-issued Plesk TLS certificates on mail services, consistent with STARTTLS abuse

The host exposes an unusually broad range of open ports, indicating a generic, over-exposed VPS template rather than a hardened production system. Critical services include SMTP (25/465), IMAP (143/993), and ManageSieve (4190), confirming the presence of a complete mail stack commonly used in phishing campaigns.

Additional exposed services such as DNS (53), SSH (22), HTTP/HTTPS (80/443), and multiple Plesk administrative interfaces (8443, 8880) further reinforce this assessment. Publicly accessible control panels are frequently abused to rapidly deploy phishing pages, manage mailboxes, and rotate campaign infrastructure.

Figure 5: Shodan Reporting

The host exposes an unusually broad range of open ports, indicating a generic, over-exposed VPS template rather than a hardened production system. Critical services include SMTP (25/465), IMAP (143/993), and ManageSieve (4190), confirming the presence of a complete mail stack commonly used in phishing campaigns.

Additional exposed services such as DNS (53), SSH (22), HTTP/HTTPS (80/443), and multiple Plesk administrative interfaces (8443, 8880) further reinforce this assessment. Publicly accessible control panels are frequently abused to rapidly deploy phishing pages, manage mailboxes, and rotate campaign infrastructure.

Detection/hunting query

With confidence in the infrastructure indicators and tactics, we moved to detection engineering. The goal wasn’t just to stop this email; it was to detect the campaign wherever it might appear next. Below is a detection/threat-hunting query used to identify further attempts.

These detections were deployed across all our customers. Although only one customer received the original phishing email, others could have been targeted next.

Why SPF, DKIM and DMARC are not enough to stop phishing

This campaign was a layered deception engineered to evade detection and exploit trust at every step. The attackers abused legitimate email infrastructure, leveraging MailChimp and a trusted business’ domain to sneak through spam filters with fully authenticated messages.

This investigation underscores how modern phishing operations have evolved. It’s no longer about crude HTML and spelling mistakes. Instead, attackers are combining brand impersonation and infrastructure-as-a-service to scale fast, phish wide, and stay ahead of basic defences.

What this means for Security Operations Centres

For a SOC, this means going beyond blocking domains. It’s about hunting infrastructure patterns, monitoring cloud mail providers like MailChimp, pivoting on TLS artefacts like JARM fingerprints, and educating users to question even the most polished messages. 

SPF, DKIM, and DMARC do not guarantee that a message is safe, only that it was not forged at the SMTP level and came from an authorised sender.

Attackers are increasingly piggybacking on trusted third-party mail platforms like MailChimp, SendGrid, Salesforce and sending through domains with properly configured email authentication. In this case, the phishing campaign weaponised trust by using a legitimate and reputable domain, to pass all filtering checks and reach the inbox clean.

SOC as a Service helps detect advanced phishing campaigns

If you’d like to understand how our SOC as a Service can help you strengthen your organisation’s security framework, get in touch with our friendly team.

MITRE Mapping:

T1566.002 – Phishing: Spearphishing Link

Detects emails that trick users into clicking malicious URLs.

T1036 – Masquerading

The attacker is impersonating a legitimate service.

T1056.007 – Input Capture: Web Portal Capture

The final payload is a fake login page to capture user credentials.

Indicators of Compromise:

HubSpot logo used for informational purposes only.