{"success":true,"data":{"id":"fake-grammarly-premium-renewal-lure","label":"Fake Grammarly Premium renewal phishing — impersonates Grammarly with subscription-expired or payment-failed urgency + renew CTA at a non-grammarly.com host. Cofense 2025-2026; Proofpoint Q1 2026.","description":"Phishing emails impersonating Grammarly claiming a Premium or Business subscription has expired or a payment has failed, directing victims to a fake renewal page that harvests login credentials and payment card data. Three-part detection: (1) Grammarly Premium / Business / subscription language, (2) expired / payment-failed / cancelled urgency, (3) renew / restore / billing-update CTA with off-grammarly.com link. Cofense 2025-2026 documented Grammarly impersonation campaigns targeting knowledge workers and writing teams; Proofpoint Q1 2026 confirmed active campaigns. High-value phishing target: Grammarly serves 30M+ daily active users, with Premium users relying on the tool for professional writing.","tier":"danger","category":"scam","isThin":false}}