Recent investigations have unveiled new malicious domains likely associated with the e-crime actor known as PoisonSeed. These domains, registered since June 1, 2025, predominantly imitate the legitimate email platform SendGrid. Their primary aim appears to be the compromise of enterprise credentials from SendGrid's customer base. To enhance the credibility of these malicious websites, they present fake Cloudflare CAPTCHA interstitials before redirecting unsuspecting users to phishing pages. While no specific target has been identified, historical data suggests that PoisonSeed has focused on cryptocurrency platforms and enterprise environments.