Clients of a long-running email marketing platform are getting targeted with a phishing campaign telling them that their emails would begin automatically inserting a \u201c\u2018Support ICE\u2019 donation button\u201d into every email they send. The strategy suggests that scammers are trying to capitalize on people\u2019s revulsion to ICE by coming up with strategies that would cause users to quickly log into their accounts to disable the setting. In reality, clients would be revealing their username and password to hackers.\u00a0The move indicates that hackers are targeting clients of enterprise software companies with extremely controversial political emails. The scam targeted customers of Emma, a long-running email marketing platform whose clients include Orange Theory, Yale University, Texas A&M University, the Cystic Fibrosis Foundation, Dogfish Head Brewery, and the YMCA, among others. 404 Media was forwarded a copy of the phishing email from an Emma client.\u201cAs part of our commitment to supporting U.S. Immigration and Customs Enforcement (ICE), we will be adding a \u2018Support ICE\u2019 donation button to the footer of every email sent through our platform,\u201d the phishing email reads. \u201cThis button will appear automatically in all outgoing emails starting next week [\u2026] all emails sent from your account will include the Support ICE footer element [\u2026] this change helps us demonstrate our platform\u2019s civic commitment.\u201d The email adds that it is possible to opt out of this feature, and that \u201cwe appreciate your understanding as we implement this platform-wide initiative.\u201dLisa Mayr, the CEO of Marigold, which owns Emma, told 404 Media that the company \u201cwould never publish anything like this. This is a very common phishing attempt.\u201dMayr is right\u2014clients of other email sending services have recently been targeted with similar attacks. In January, programmer Fred Benenson wrote about phishing emails he had gotten that were targeting users of SendGrid, another email marketing service. At least one of the emails Benenson got used the same \u201cSupport ICE button\u201d language and has the subject line \u201cICE Support Initiative.\u201d\u201cIf you\u2019ve been paying any attention at all to US politics, you\u2019ll know how insidiously provocative this would be if it were a real email,\u201d Benenson wrote in a blog post about the email. \u201cThis phishing campaign is a fascinating example of how sophisticated social engineering has become. Instead of Nigerian 419 scams, hackers have evolved to carefully craft messages sent to professionals that are designed to exploit the American political consciousness. The opt-out buttons are the trap.\u201dIn SendGrid\u2019s case, Benenson found that the emails looked \u201creal\u201d because they were sent from other SendGrid user accounts. Basically, hackers compromised the account of a SendGrid user and then used that account to send phishing emails using the SendGrid infrastructure. \u201cThe emails look real because, technically, they are real SendGrid emails sent via SendGrid\u2019s platform and via a customer\u2019s reputation\u2013they\u2019re just sent by the wrong people and wrong domains,\u201d he wrote.\u00a0Besides the ICE-themed phishing emails, Benenson also received an email that said SendGrid was going to add a \u201cpride-themed footer to all emails\u201d and another that said \u201call emails sent from your account will feature a commemorative theme honoring George Floyd and the Black Lives Matter movement.\u201d\u201cThe political sophistication on display here (BLM, LGBTQ+ rights, ICE, even the Spanish language switch playing on immigration anxieties) suggests someone with a deep understanding of American cultural fault lines,\u201d Benenson wrote.The Emma email was sent via Survey Monkey through an email address called \u201cmyemma@help-myemma.app.\u201d When users clicked a \u201cSettings\u201d button that would have allowed them to opt out of the feature, they\u2019re sent to a generic-looking site designed to steal credentials hosted at app-e2maa.net. By the time 404 Media got the email, Chrome had detected it as a \u201cDangerous site\u201d and warned users not to visit it.<\/p>\n","protected":false},"excerpt":{"rendered":"