May 9, 2024 at 06:18PM
Monday.com, a widely used project management platform, has removed its “Share Update” feature due to abuse by threat actors in phishing attacks. Customers received phishing emails purportedly from Monday.com’s email accounts, prompting concerns of a security breach. The company confirmed that the feature was misused, leading to its suspension, and is under review for potential restoration.
Key takeaways from the meeting notes:
– Monday.com removed the “Share Update” feature after it was misused in phishing attacks by threat actors.
– The phishing emails were sent from Monday.com’s email accounts using SendGrid and included links to phishing forms on formstack.com. These forms have since been disabled.
– Monday.com confirmed that the phishing attacks were conducted through the ‘Share Update’ feature, which allows users to share an update with someone who isn’t a member of their account.
– The company promptly suspended the user who misused the feature and removed the feature itself.
– Monday.com stated that the ‘Share Update’ feature has no connection to data hosted on Monday.com or access to any customer accounts or data.
– They have reached out and shared precautions with the email recipients of the phishing message.
– Monday.com declined to disclose the number of people who received the phishing emails for security reasons but assured that they contacted all recipients to warn them.
– The ‘Share Update’ feature is under review, and Monday.com cannot provide a timeline for when or if the feature will be restored.
Let me know if you need any further assistance or clarification.