{"success":true,"data":{"id":"fake-circleci-buildkite-cicd-pipeline-billing-phish","label":"Fake CircleCI / Buildkite / Travis CI CI/CD pipeline subscription payment failed, pipelines suspended, or deployments halted phishing — fraudulent email impersonating CircleCI, Buildkite, or Travis CI claiming the subscription payment has failed, CI/CD pipelines are suspended, builds are halted, or deployments are blocked — CircleCI: 30K+ paying organizations, 500K+ developers ($30-2,000+/month), used by Spotify, Segment, and thousands of tech companies; Buildkite: 2,000+ enterprise customers including GitHub, Shopify, and Stripe; Travis CI: legacy CI/CD widely used in open source; distinct from GitHub/GitLab devops platform billing — targets dedicated CI/CD pipeline tooling; suspended CI/CD pipelines block all code deployments to production, halting feature releases, hotfix deployments, and automated test execution simultaneously","description":"Phishing emails impersonating CircleCI, Buildkite, or Travis CI claiming the CI/CD pipeline subscription payment has failed, pipelines and builds are suspended, deployments have been halted, or CI/CD workflows are no longer active — directing them to update billing or restore their CI/CD platform through a credential-harvesting portal. Distinct from GitHub/GitLab DevOps platform billing phishing — targets dedicated CI/CD pipeline tooling used specifically for automated build, test, and deployment workflows. Key facts: (1) CI/CD pipeline suspension blocks all code deployments to production simultaneously: CircleCI serves 30,000+ paying organizations with 500,000+ developers ($30-2,000+/month) used by companies like Spotify, Segment, Twilio, and thousands of SaaS startups — when a CircleCI subscription lapses and pipelines are suspended, every triggered pipeline (from every developer's code push) fails immediately; feature releases, hotfix deployments, automated test runs, and scheduled nightly builds all halt; development teams operating under continuous deployment (multiple deploys per day) experience an immediate production deployment freeze; (2) Buildkite's enterprise architecture creates high-stakes organizational disruption: Buildkite serves 2,000+ enterprise customers including GitHub, Shopify, and Stripe — Buildkite's 'bring your own agents' architecture means Buildkite suspension affects the central Buildkite API layer that orchestrates self-hosted build agents; even though the build agents run on the customer's infrastructure, they cannot receive pipeline definitions or report build results to a suspended Buildkite account; (3) Travis CI's legacy position creates vulnerability through outdated security awareness: Travis CI has been used since 2011 and many developers received their first CI/CD experience on it — the 'your Travis CI subscription has failed' lure is effective because older users may not know that Travis CI moved to a paid-only model in 2021 (ending the free tier) and many may have received previous legitimate billing communications; (4) CI/CD pipeline credentials give attackers access to deployment secrets (SSH keys, cloud provider API keys, database migration credentials), container registry credentials, and the pipeline configuration that reveals the entire deployment architecture and production infrastructure; (5) The 'deployments halted' hook is particularly effective for teams in the middle of an incident response — a team rushing to deploy a hotfix for a production incident is maximally susceptible to clicking a 'restore your CircleCI account' link without verifying. Warning signs: sender not circleci.com/buildkite.com/travis-ci.com; genuine CI/CD billing in account settings; pipeline providers do not require password re-entry in billing failure emails.","tier":"danger","category":"phishing","isThin":false}}