On October 19, 2026, a his.com customer account was hijacked and used to send phishing spam to a number of his.com addresses.
This message had the title “You have a New Activity” and claimed that the recipient’s account had been logged into from Russia.
The message contained a link to “Review Login Activity“. This led to a bogus login page where you were prompted to enter your email address and password. If you were to do this, the bad guys would have your login credentials, and your mailbox would soon be exploited to send spam.
This is a classic phishing message crafted to look like an official notification from your email provider, containing a bogus notification that your email account had been compromised from another country.
If you received one of these messages, delete it.
These messages came from a compromised Amazon Web Services account in California. We have reported this to AWS, and we have reported the link used to harvest email credentials to Google so it can be blocked in Chrome, Firefox, and Edge.