Finance-themed phishing via ActiveCampaign infra w/ disposable domain rotation

Ankit Mehta@Secvyn

•updated Sep 5, 2026•1•0•3

Detects inbound emails that use a combination of finance-related keyword patterns in the domain and ActiveCampaign-specific relay infrastructure naming conventions. This technique is often used in phishing campaigns to bypass filters by leveraging trusted third-party email service provider infrastructure.