{
 "tag": "sendgrid",
 "name": "Sendgrid",
 "group": "Other",
 "incidents": [
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  }
 ],
 "changes": [
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  }
 ]
}