PoisonSeed Threat Actor Strengthens Credential Theft Operations with New Domains

PoisonSeed threat actor is reported to have strengthened credential theft operations by registering a new wave of domains designed to harvest enterprise credentials. According to DomainTools Investigations, 21 newly registered domains exhibiting hallmarks of PoisonSeed have been identified since 1 June 2025, with most names referencing SendGrid and other generic digital services.

The domains were registered via the NiceNIC International Group Co. registrar and hosted on IP addresses assigned to Global-Data System IT Corporation (AS42624), with a partial list including loginportalsg[.]com, sgaccountsettings[.]com, and my-sandgrid[.]com. A key tactic involves presenting fake Cloudflare CAPTCHA interstitials to lull victims into entering credentials, with analysis via URLScan[.]io showing many domains deliver identical interstitials to those documented by Mimecast Threat Research in May 2025.

The article notes potential operational ties or shared personnel between PoisonSeed and SCATTERED SPIDER, a member of “The Com” collective, though no direct evidence links the new domains to sector breaches. Security teams are urged to monitor NiceNIC-registered domains, look for CAPTCHA impersonation, and enforce multi-factor authentication to mitigate credential harvests.