{"success":true,"data":{"id":"fake-grammarly-semrush-professional-tool-subscription-phish","label":"Fake Grammarly Premium / SEMrush Pro / Ahrefs professional writing or SEO tool subscription payment failed, account suspended, or keyword data at risk phishing — fraudulent email impersonating Grammarly, SEMrush, Ahrefs, or Moz claiming the recipient's professional tool subscription payment has failed, their account has been suspended, their premium writing features or keyword research data are no longer accessible, or an unauthorized charge was detected — directing them to update billing, restore access, or sign in through a credential-harvesting portal; Grammarly 30M+ daily active users with 1M+ Premium/Business subscribers ($12-15/month); SEMrush 10M+ registered users with 1M+ paying subscribers ($119-449/month); Ahrefs 500K+ subscribers ($99-999/month); Moz 500K+ subscribers; professional tool account compromise gives attackers access to writing documents, SEO strategy data, competitor intelligence, and linked Google/Microsoft credentials","description":"Phishing emails impersonating Grammarly, SEMrush, Ahrefs, or Moz claiming the recipient's professional writing or SEO tool subscription payment has failed, their account has been suspended, their keyword research data and SEO reports are no longer accessible, or an unauthorized charge was detected — directing them to update billing, restore access, or sign in through a credential-harvesting portal. Key facts: (1) Grammarly's browser extension ubiquity creates a uniquely intimate attack surface: Grammarly is installed as a browser extension by 30M+ daily active users (1M+ Premium/Business subscribers at $12-15/user/month) and is actively embedded in every writing session — email, documents, LinkedIn, social media; users see the Grammarly icon constantly and associate Grammarly emails with a trusted productivity companion; Grammarly Business subscribers depend on team writing consistency for professional output, making 'your entire team's access has been revoked' a business-disrupting threat; (2) SEMrush creates professional data-loss anxiety: 1M+ paying subscribers ($119-449/month Guru/Business) use SEMrush for keyword research campaigns, competitor analysis, and SEO audits that directly drive business revenue; 'your SEMrush subscription is suspended and your keyword research data and campaigns are no longer accessible' threatens active marketing work and client deliverables; SEMrush Business subscribers store campaign data, competitor tracking, and client SEO reports within the platform — losing access during an active client campaign creates serious professional consequences; (3) Ahrefs (500K+ subscribers, $99-999/month) stores backlink analysis data representing months of link-building research; losing Ahrefs access mid-campaign means losing the ability to track a core SEO metric; the high monthly cost ($99-999) makes the 'billing failure' lure highly plausible — users do sometimes have payment issues at these price points; (4) Professional tool accounts contain OAuth-linked credentials (Google Analytics, Google Search Console, Google Ads, Facebook Ads Manager), client website access permissions, and confidential SEO strategy data — making them high-value targets beyond simple credential theft; (5) This signal is distinct from office suite phishing (Microsoft 365/Google Workspace) — it specifically targets individual marketing/writing professionals who use these niche tools daily and are accustomed to billing communications from them. Warning signs: sender domain not grammarly.com, semrush.com, ahrefs.com, or moz.com; Grammarly always includes your account email and plan type in billing communications; any subscription issue should be resolved via direct navigation to the official website.","tier":"danger","category":"phishing","isThin":false}}