Passport Foundation attributed the phishing emails sent from its official domains to compromised Cloudflare API keys, then revoked all keys and took down the malicious domain. It identified more than 23,000 phishing attempts, including about 19,000 through Mailgun and just over 1,500 via Google Workspace. Order records left in legacy WooCommerce tables, along with information in refund records, abandoned carts and contact forms, were accessible to the attackers; however, 5,000 addresses that received the emails did not appear in the WooCommerce or Shopify records. The foundation is rotating keys across its systems and keeping the legacy WooCommerce data offline until the investigation is complete. It says it has found no evidence that Passport devices or the private keys they held were compromised.
Source: Read the original article
