{"success":true,"data":{"id":"fake-contentful-sanity-headless-cms-billing-phish","label":"Fake Contentful / Sanity / Storyblok headless CMS subscription payment failed, content delivery suspended, or CMS spaces and entries inaccessible phishing — fraudulent email impersonating Contentful, Sanity, or Storyblok claiming the subscription payment has failed, content delivery is suspended, or CMS spaces, datasets, and entries are no longer accessible — Contentful: 30% of Fortune 500 companies, 7K+ enterprise customers ($300-2,000+/month); Sanity: 1,000+ enterprise customers; headless CMS suspension takes down every website and app that reads content from the CMS simultaneously — the entire digital presence goes content-dark at once","description":"Phishing emails impersonating Contentful, Sanity, or Storyblok claiming the headless CMS subscription payment has failed, content delivery is suspended, or CMS spaces, datasets, and entries are no longer accessible — directing them to update billing or restore CMS access through a credential-harvesting portal. Key facts: (1) Headless CMS suspension takes down every website and app that reads from it simultaneously: Contentful serves 30%+ of Fortune 500 companies with 7,000+ enterprise customers ($300-2,000+/month Team/Scale/Enterprise) as the content backend for websites, mobile apps, digital signage, and e-commerce storefronts — when a Contentful space is suspended, every channel that fetches content from that space returns empty content or API errors; a retailer's website loses all product descriptions, a news site loses all articles, a mobile app shows blank screens — the entire content layer across all digital channels goes dark simultaneously; (2) Contentful's content delivery API vs. content management API creates a two-vector attack: Contentful separates the CDA (public delivery, used by websites) from the CMA (management, used by editors); a suspension message claiming 'your content delivery API access has been suspended' resonates with both technical teams (who manage the API keys) and editorial teams (who fear losing published content), making the phishing lure credible to multiple personas in the same organization; (3) Sanity's real-time collaboration model creates visible failure for creative teams: Sanity serves 1,000+ enterprise customers with a real-time content studio where multiple editors work simultaneously on content; when Sanity access is suspended, all editors are locked out of the content studio simultaneously — a content team with multiple in-progress articles, a marketing team finalizing a campaign launch, and an e-commerce team updating product pages all lose access in a single billing failure; (4) Storyblok's visual editor creates a non-technical editor target pool: Storyblok serves marketing and content teams who use a visual drag-and-drop editor (not a technical API); non-technical marketing users who receive a 'your Storyblok subscription payment has failed' email have no technical basis to verify the sender and are more likely to click without domain verification; (5) Headless CMS API keys stored in the platform give attackers access to all content management credentials, content delivery API tokens that can be used to read all content data, webhook configurations that expose integration endpoints, and in some cases management tokens that allow content modification. Warning signs: sender not contentful.com, sanity.io, or storyblok.com; genuine CMS billing is always managed through the in-platform billing dashboard.","tier":"danger","category":"phishing","isThin":false}}