Exposed SendGrid API Keys Enabled 2.3 Million Emails and Phishing
Summary
An exposed SendGrid API key was abused to send 2.3 million emails, driving a company’s Twilio bill above 500× its usual level. The article also describes phishing sent through a compromised Purdue SendGrid account and recommends limiting, scoping, and rotating keys and,
Key points
- A company’s exposed SendGrid API keys were abused to send 2.3 million emails; the article says its Twilio bill rose more than 500×.
- The company’s engineering vendor said the keys were exposed because of what it believed was a NextJS vulnerability; the article does not identify a specific vulnerability.
- The company revoked the keys, but its domain reputation and email deliverability were affected.
- A phishing email sent through a compromised Purdue University SendGrid account passed SPF and DKIM because it was sent through Purdue’s authenticated domain.
- The phishing message impersonated SendGrid and linked to a credential-harvesting site on a domain registered that day.
- The article says Purdue changed its DMARC policy to p=quarantine and Purdue and SendGrid closed the hole; DMARC policy alone does not prevent abuse of valid keys.
- Recommended defenses include limiting and scoping API keys, rotating API and DKIM keys, and monitoring DMARC reports and sending volume.
Article Details
- Defense Focus
- Prevent and detect abuse of exposed SendGrid API keys that enables high-volume authenticated email and phishing.
- Detection Methods
- Review DMARC reports for abnormal outbound-email surges from authenticated domains.
- Monitor sending volume for unexpected spikes.
- Data Sources
- DMARC reports
- Outbound email sending-volume records
- SPF and DKIM authentication results
- Defensive Actions
- Restrict which people and systems can access API keys.
- Issue a separate API key to each system and grant only the permissions it needs.
- Revoke exposed API keys promptly and rotate API and DKIM keys on a schedule.
- Do not rely on DMARC policy alone to prevent abuse of valid API keys.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing link led to a credential-harvesting site intended to capture credentials.T1078 · Valid AccountsAttackers abused exposed, valid SendGrid API keys to send 2.3 million emails through the company’s authenticated infrastructure.T1566.002 · Spearphishing LinkPhishing sent through a compromised SendGrid account included a link to a credential-harvesting site.