“the criminals can use the compromised accounts to compromise further SendGrid accounts in a cycle, providing them with a steady supply of fresh SendGrid accounts.”
The phishing mails come from SendGrid’s own servers, sent through hijacked customer accounts, with links hidden behind SendGrid’s click tracking. The fake login page even calls SendGrid’s API to send the real 2FA code, then steals the session token. SendGrid sells an “industry-leading 99% delivery rate,” and the phishers get it too. Netcraft reported it on February 1.