Foundation Says Phishing Emails Sent Using Compromised Cloudflare API Keys

Overview

• Foundation said Monday that phishing emails appearing to come from its official domains were traced to one or more compromised Cloudflare API keys and that the company revoked those keys and removed the malicious domain.
• CEO Zach Herbert said the attackers likely exploited a vulnerability in a self-hosted backend application and that the company disabled the unauthorized email activity and removed attacker access within about ten minutes of user reports.
• Multiple recipients reported that the fraudulent messages included real names, shipping addresses and past purchase details, but Foundation has not disclosed how many people were targeted or whether anyone followed the emails’ instructions.
• Foundation says Passport hardware and the funds stored on it were not breached and that the primary danger is social-engineering if users enter recovery phrases on fake sites.
• The company is investigating the full scope of the incident, plans a formal report after the inquiry and noted the case follows similar recent wallet-industry phishing episodes that used compromised email or site-authorisation systems.