{"success":true,"data":{"id":"fake-fly-io-credit-card-failed-billing-phish","label":"Fake Fly.io platform credit card failed / app suspended phishing — impersonates Fly.io with payment-failed or app-suspended urgency + update-payment CTA at a non-fly.io host. Proofpoint / Abnormal Security 2025-2026.","description":"Phishing emails impersonating Fly.io claiming a credit card payment has failed and apps are suspended or at risk of termination, directing victims to a fake billing portal harvesting Fly.io credentials and payment card data. Three-part detection: (1) Fly.io account / billing / app / organization language, (2) credit-card-failed or app-suspended urgency, (3) update-payment / add-card / sign-in CTA with off-fly.io link. Proofpoint and Abnormal Security 2025-2026 documented developer cloud platform impersonation campaigns; active campaigns targeting DevOps teams confirmed. Fly.io hosts thousands of production applications — account compromise enables attackers to steal app secrets, exfiltrate data, and redirect production traffic.","tier":"danger","category":"phishing","isThin":false}}