There is a targeted phishing campaign happening right now involving the Foundation (npub1s0v…pq6j) email domain. Messages are being sent to a large number of addresses that have appeared in data breaches urging people to migrate funds from their devices.
Obviously this is a scam, and there’s no indication that Foundation’s own data was leaked, but the question I want an answer to is how were these attackers able to spoof the email headers to allow these emails to appear legitimate?
