Quick Answer — On February 27, 2023, customers of Namecheap — one of the world’s largest domain registrars — started receiving Metamask/DHL-themed phishing emails sent through Namecheap’s own legitimate SendGrid account. An attacker had compromised an employee account at a SendGrid supplier, then pivoted into the mail pipeline Namecheap (and others) trusted. The emails passed SPF, DKIM, and DMARC because they genuinely came from authorized infrastructure. The lesson: email authentication proves the sender’s pipeline, not the sender’s intent — your vendors’ vendors are your phishing surface.
What happened
- The send: Starting ~UTC morning Feb 27, phishing mail themed around MetaMask wallet “verification” (plus some DHL and other brands in the wider campaign) went out with valid SendGrid headers under domains recipients already trusted.
- The root cause chain: Per Twilio/SendGrid’s statements, an attacker compromised an employee account at a.SendGrid supplier/subcontractor, gaining access to a set of customer accounts — including Namecheap’s — and abused the managed-service mail path.
- Why mail auth didn’t help: The mail was signed and aligned: a legitimate ESP with legitimate routing and authorized API usage. DMARC has no opinion on whether the authorized user is actually a hijacker upstream.
- Scope: Beyond Namecheap, reports surfaced of similar sends tied to other SendGrid-using brands the same week; the blast was punctuated by waves and pauses as SendGrid killed the access.
Why ESP compromise defeats mail authentication
| Control | Status during incident |
|---|---|
| SPF | Pass — mail genuinely originated from SendGrid’s authorized IPs |
| DKIM | Pass — signed with the real key the brand configured |
| DMARC | Pass — full alignment, zero quarantining reason |
| Reputation systems | Saw a trusted sender behaving (mostly) normally — no quarantine reason |
| Human factor | Only remaining control: recipients noticing content anomalies in “legitimate” mail |
The attack pattern
- Target an ESP’s own supply chain (a supplier/subcontractor employee), not the customer brand — inherit trust wholesale instead of forging it.
- Pick customer accounts with broad legitimate send volume (registrars, SaaS) so the malicious blast blends into normal flow.
- Theme lures for crypto-wallet urgency (MetaMask verifications were hot that season) to monetize fast before revocation.
- Ride the vicarious-trust halo: security training teaches “check for the lock, check the domain”; here the domain was right and the content almost right.
Timeline
| Date | Event |
|---|---|
| 2023-02-27 ~06:00 UTC | First wave of MetaMask/DHL-themed phish from Namecheap’s SendGrid account; customers flood social |
| 2023-02-27 morning | Namecheap acknowledges compromise of its SendGrid email account; sends suspended |
| 2023-02-27 → 28 | Twilio/SendGrid attributes root cause to a compromised account at a supplier; access revoked |
| 2023-03 | Wider analysis: same supplier-compromise class hits other ESP customers; “trusted-sender phish” writeups land |
| 2023 → 2024 | ESP/CDN-style trusted-infrastructure phishing becomes a standing category (adversary-in-the-middle kits, hijacked verified accounts) |
Defensive lessons
- Contract for blast-radius controls. ESP accounts need per-sender IP separation, send-volume anomalies alerted, and instant-revoke runbooks — agreed with the vendor before the incident, not during.
- Train for content anomalies, not just header anomalies. “Looks like a legit domain” is no longer evidence of safety when the pipeline itself can be hijacked; teach recipients to treat urgency + embedded links as the signal.
- Reduce single-vendor mail dependency. Splitting transactional and marketing sends across providers (or dedicated subdomains) caps how much “your” reputation one compromise can torch.
- Monitor your own mailstreams from outside. Brands that caught this fastest saw their own transactional templates being abused via honeypot inboxes and threat-intel feeds — not vendor notifications.
- Vendors: segment employee access by customer blast radius. One supplier-side credential shouldn’t reach a top-ten customer’s send path; least-privilege applies to the mail pipeline too.
Why it still matters in 2026
This incident codified vicarious trust abuse as a first-class phishing vector: subsequent years brought hijacked verified business accounts, compromised marketing automation, and AI-personalized sends riding legit pipelines. In 2026, mail authentication (DMARC, BIMI’s shiny checkmarks included) is table stakes that verifies infrastructure identity, while the actual arms race has moved to behavioral and content-layer detection — anomaly models on send patterns, link-graph analysis, and user education rebuilt around “the sender can be the victim.” The Namecheap/SendGrid case remains the clean teaching example: every header said yes, and every header was honest. Only the intent was false.
Did any recipient protection work?
Partially. Mail providers’ content-level filtering and recipient skepticism caught many samples, and the crypto-lure landing pages were taken down quickly. But the incident proved the ceiling: authentication-based trust had zero defensive value, and reputation systems initially scored the mail as genuine. Protections that fired were the ones modeling what was sent and how abruptly, not who sent it.
Why was a registrar’s mail account such a target?
Scale plus trust: registrars email customers about domains, renewals, and DNS — topics with built-in urgency and authority. A phisher inheriting that channel inherits millions of primed recipients, many of them non-technical. It’s the same logic as targeting a password-reset pipeline: own the channel people are trained to obey.
Was Namecheap itself hacked?
No — and that’s the point. Namecheap’s own systems weren’t breached; its email service provider’s supplier chain was. Per statements, the compromise lived upstream at SendGrid/supplier level, which is why the failure felt invisible to both Namecheap and its customers until the mail started arriving. The case is a required citation in any serious third-party risk program for exactly that reason.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
