Finance.Biggo Phishing Attack Targets Foundation Passport Wallet Users via Compromised Cloudflare API Keys
Article Content
- •Phishing emails impersonated Foundation's official domains using compromised Cloudflare API keys.
- •Personal information in the emails may have originated from the company's support inbox or leaked databases.
- •Foundation has confirmed that customer funds and hardware are safe, and a formal report is forthcoming.
On October 26, 2026, Foundation, the maker of the Passport bitcoin hardware wallet, reported a phishing attack where fraudulent emails appeared to originate from its official domains. The attack was traced to compromised Cloudflare API keys, which allowed attackers to bypass authenticity checks. The emails urged recipients to relocate funds and included personal information such as mailing addresses and phone numbers, likely sourced from the company's customer support inbox or leaked databases. Foundation revoked all compromised API keys and took down the malicious domain linked in the emails. CEO Zach Herbert confirmed that customer funds and hardware remain secure, and a formal incident report is expected soon. The company has not disclosed how many customers received the phishing emails or if any acted on them. Users are advised to treat any suspicious communication with caution until further information is provided.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (7)
Following this threat?
Track Cloudflare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Are my funds at risk?
What should I do if I received a suspicious email?
When will the formal incident report be available?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…