Quick Summary
GrubHub users received fraudulent emails claiming a tenfold return on bitcoin sent to a specified wallet. The emails, which appeared to come from legitimate GrubHub addresses, were part of a ‘Holiday Crypto Promotion’ that misled recipients into believing they could profit significantly. GrubHub has acknowledged the issue and is investigating the unauthorized messages sent to its merchant partners.
The Securityish Brief
GrubHub users were targeted by a phishing scam involving fraudulent emails that promised a tenfold return on bitcoin transfers. These emails were sent from addresses like ‘merry-christmast@b.grubhub.com’ and ‘crypto-promotion@b.grubhub.com’ starting December 24, 2025. The messages claimed that if users sent $1,000 in bitcoin, they would receive $10,000 back, creating a false sense of urgency with phrases like ’30 minutes left in our Holiday Crypto Promotion.’
This type of scam, known as a crypto reward scam, exploits the trust users have in established brands like GrubHub. Although some users speculated that the emails resulted from a DNS takeover attack, GrubHub has not confirmed this and is currently investigating the incident. A spokesperson stated that the company has isolated the problem and is taking steps to prevent future occurrences.
The incident is particularly concerning given that GrubHub had previously reported a data breach at the beginning of the year, where a threat actor accessed sensitive information, including names, email addresses, and phone numbers of customers and partners. This breach was linked to a third-party account used for support services, raising questions about the security of third-party integrations.
Understanding the Risks
This phishing attack highlights the ongoing risks associated with cryptocurrency scams, especially during promotional periods when users may be more susceptible to offers that seem too good to be true. Users should be cautious of unsolicited emails, even those that appear to come from legitimate sources.
Organizations like GrubHub must enhance their security measures and educate users about recognizing phishing attempts. This includes monitoring email communications and ensuring that any promotions are communicated through verified channels.
For everyday users, it is essential to remain vigilant and skeptical of any unsolicited requests for cryptocurrency transfers, regardless of the sender’s identity. Always verify promotions directly through official company websites or customer service channels.
- GrubHub: A food delivery service targeted by a phishing scam promising high returns on bitcoin.
- Holiday Crypto Promotion: The fraudulent campaign that misled users into sending cryptocurrency.
- DNS takeover attack: A potential method speculated by users that could allow scammers to send authentic-looking emails.
- Phishing scam: A type of fraud where attackers impersonate legitimate entities to steal money or information.
- Data breach: An incident earlier this year where GrubHub’s customer data was accessed by a threat actor.
Key Takeaways
- Be cautious of unsolicited emails promising high returns on cryptocurrency investments.
- Verify any promotions directly through official company websites or customer service channels.
- Monitor your email for suspicious messages that appear to come from legitimate sources.
- Educate yourself about common phishing tactics to better recognize potential scams.
- Consider using two-factor authentication for added security on your accounts.
Key Terms & Concepts
- Phishing scam: In this article, phishing scam refers to fraudulent attempts to trick individuals into sending money or personal information by impersonating legitimate entities.
- DNS takeover attack: In this article, DNS takeover attack refers to a method where attackers gain control over a domain’s DNS settings to send deceptive emails.
- Data breach: In this article, data breach refers to an incident where unauthorized individuals accessed sensitive information from GrubHub’s systems.
Read the original article here: https://www.bleepingcomputer.com/news/security/fake-grubhub-emails-promise-tenfold-return-on-sent-cryptocurrency/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
