Monday.com eliminates "Share Update" feature due to misuse in phishing attacks

Project management platform Monday.com has terminated its "Stake Update" segment after hazard actors manipulated it in phishing seizures. Monday.com is a cloud-based undertaking surveillance medium that permits groups to manage and control their job utilizing automatic workflows and dashboards. The medium is utilized by 225,000 clients, including Coca-Cola, Canva, LionsGate, Oxy, Compass, and Zippo.

On Tuesday, Monday.com customers were notified that they were concerned that the company was compromised after obtaining phishing emails from its email reports. These emails were mailed using SendGrid and came from notifications@monday.com, handling SPF, DMARC, and DKIM authentication. The phishing emails acted to come from a "Human Resources" unit, requesting users to either accept the "association's workplace sex guideline" or propose feedback as a region of a "2024 Employee Evaluation."

The conditions associated with these phishing movements have since been disabled, so they do not know what details were being collected. After reaching Monday.com about the phishing attacks earlier this week, they conveyed to them today that the attacks were executed through their 'Share Update' segment.

"We were created conscious of the mishandling of a monday.com feature named "Share Update," which permits users to convey an update with somebody who isn't an associate of their account," a Monday.com representative informed them. "Unfortunately, a user misapplied this feature by transmitting a phishing note. We promptly arrested this user and dismissed the feature."

"This feature has no relation to data hosted on monday.com or key to any consumer accounts or data. We have arrived and transferred protection with the email recipients of the phishing letter." Monday.com states that the danger actor manipulated this feature by inputting a list of email addresses to which a report should be transmitted, which can contain people further from their community.

When questioned about how many individuals accepted an email, they refused to respond for safety reasons but communicated they reached all recipients to alert them of the phishing emails. For those who utilized the 'Share Update' feature, Monday.com conveyed that it is under consideration and cannot supply a timeline for when or if the attribute will be restored.

Search

Recent News