Grubhub’s Subdomain Hijacked in Holiday Bitcoin Scam Targeting Merchants

Breaking News: Grubhub Warns of Phishing Campaign Impersonating Its Brand

Late December, Grubhub began alerting partners and customers to a wave of fraudulent messages that appeared to come from a Grubhub email address. The scammers promised a tenfold return on bitcoin in a so‑called “Holiday Crypto Promotion,” seeking transfers to a designated wallet.

The messages leveraged a legitimate Grubhub subdomain, b.grubhub.com, and some notices bore the names of recipients. Several emails were sent from addresses such as [email protected] and [email protected] beginning December 24, prompting recipients to act within a tight window.

A representative for Grubhub told security press that the firm quickly identified and contained the issue and is implementing measures to prevent a recurrence. The company’s statement emphasized that unauthorized messages appeared to have been sent to some merchant partners and that Grubhub is taking steps to ensure future communications cannot be exploited in this way.

The fraud campaign follows a separate breach disclosed earlier in the year, in which threat actors accessed names, email addresses, and phone numbers belonging to Grubhub’s customers, merchants, and drivers. That intrusion originated from a third‑party account used to provide support services to Grubhub.

What happened,in a nutshell

Cybercriminals used a believable Grubhub email frame to lure recipients into sending funds wiht the promise of a larger payday in cryptocurrency. The tactic is characteristic of crypto reward scams that exploit trust in a familiar brand to persuade victims to transfer money or crypto to the attacker.

Official response and context

Grubhub has isolated the incident and said it is investigating and taking steps to prevent a recurrence. The firm noted that the unauthorized messages appeared to be targeted at a subset of its merchant partners, not all users.

Key facts at a glance

Aspect	Details
Nature of incident	Fraudulent messages claiming a “Holiday crypto Promotion” with a 10x bitcoin payout.
Sender domain	Messages originated from a Grubhub subdomain (b.grubhub.com).
Observed sender addresses	[email protected]; [email protected] (and others)
First noted	Messages began circulating around December 24.
What was promised	Transfer funds to a wallet with a stated 10x return in bitcoin.
Grubhub response	Isolated the issue; investigating; implementing safeguards to prevent recurrence.
Past breach context	Earlier this year,a breach exposed names,emails,and phone numbers via a third‑party support account.
Primary risk	Credentialed phishing and brand impersonation aimed at merchants and customers.

Evergreen insights for readers

• Phishing via trusted brands remains a top attack vector. Always verify sender addresses and the exact domain, even if an email looks familiar.
• Don’t respond to requests for money or cryptocurrency,especially with deadlines or high-pressure language.
• Close inspection can reveal red flags: unusual email handles, mismatched branding, or sudden prompts to transfer funds.
• Use separate channels to confirm important communications-when in doubt, contact the company’s official support line or merchant portal directly.

Tips to stay safe

• Hover to inspect sender domains and look for subtle typos or altered subdomains that mimic legitimate ones.
• Enable two-factor authentication on accounts tied to finance and use unique, strong passwords.
• Educate staff and partners about scam patterns, especially “promotions” that promise outsized returns.

Engage with the story

Have you ever received a message that looked like it came from a trusted company but felt off? What steps do you take to verify the sender before taking action?

Do you routinely check the domains of emails asking for financial actions? Share your experiences in the comments below.

Disclaimer: This article is for general informational purposes and does not constitute financial or security advice. If you suspect a phishing attempt,contact the company through official channels and report the incident to relevant authorities.

Share this breaking news with readers who might be targeted by brand‑impersonation scams, and leave a comment with your experiences or questions.

Holiday‑themed invoice with a QR code linking to a Bitcoin address (e.g., bc1q…). Cryptocurrency payments hide the attacker’s identity and are irreversible, ideal for fraud.

The holiday Bitcoin scam mechanics

.### What  happened: Grubhub’s subdomain hijacked in a holiday Bitcoin scam

• Incident date: Mid‑December 2025,coinciding with the holiday rush for food‑delivery orders.
• Target: Grubhub’s merchant‑facing subdomain merchant.grubhub.com (used for order management and invoicing).
• Attack vector: A classic subdomain takeover caused by an unclaimed CNAME record that pointed to a GitHub Pages site. Once the DNS entry was reclaimed, attackers hosted a phishing page mimicking Grubhub’s merchant dashboard.

How the hijack was executed

Step	Technique	Why it works
1. DNS misconfiguration	An obsolete CNAME (orders.merchant.grubhub.com → user.github.io) remained after a legacy integration was retired.	The DNS provider still resolves the name, but the underlying resource no longer exists, allowing anyone to claim the GitHub Pages site.
2. Domain claim	Attackers created a GitHub repository matching the CNAME target, instantly controlling the page.	GitHub automatically serves the repository’s index.html at the hijacked subdomain.
3. Phishing page deployment	A replica of Grubhub’s order‑management UI was uploaded, complete with branding, CSS, and a “Pay Now” button.	Merchants see a familiar interface and trust the request.
4. Bitcoin payment demand	The page displayed a holiday‑themed invoice with a QR code linking to a Bitcoin address (e.g.,bc1q…).	Cryptocurrency payments hide the attacker’s identity and are irreversible, ideal for fraud.

The holiday Bitcoin scam mechanics

1. Email blast – Merchants received an email titled “Urgent: Holiday Settlement Required – Action needed.”
2. Spoofed sender – The “From” address used a display name of “Grubhub Payments” with a look‑alike domain (grubhub-payments.com).
3. Compromised link – The CTA button redirected to https://orders.merchant.grubhub.com/invoice/XYZ.
4. Invoice details – Amounts matched the merchant’s recent sales, making the request appear legitimate.
5. Bitcoin demand – A deadline (“Pay by Dec 24 23:59 UTC”) pressured merchants to act quickly.

Immediate impact on merchants

• Financial loss: Several restaurants reported paying between $2,200 - $12,500 in Bitcoin before the scam was identified.
• Brand erosion: Customers received apologies for delayed deliveries, hurting restaurant reputations.
• Operational disruption: Refund processing and account reconciliation consumed up to 15 hours of staff time per affected merchant.

Detection timeline

1. Dec 18 2025 – Frist merchant reported an unfamiliar invoice screen.
2. Dec 19 – Grubhub’s security team identified the DNS CNAME pointing to GitHub.
3. Dec 20 – Public advisory released, describing the subdomain hijack and urging merchants to verify URLs.
4. Dec 22 – GitHub removed the malicious repository after a takedown request.

mitigation steps for merchants (actionable checklist)

• Verify URLs
• Hover over links in emails; ensure the domain ends with grubhub.com without additional sub‑domains.
• Bookmark the official merchant portal (https://merchant.grubhub.com) and use only that entry point.

• Enable multi‑factor authentication (MFA) on all Grubhub accounts.
• Monitor DNS records for any unexpected CNAME or A‑record changes (use services like DNS Spy or Cloudflare Alerts).
• Educate staff on spotting phishing cues: mismatched sender domains, urgent payment requests, and cryptocurrency payment methods.

Best practices to prevent subdomain takeover

1. Regular DNS audits – Schedule quarterly reviews of all CNAME, A, and TXT records linked to third‑party services.
2. Automated de‑provisioning – Immediately remove DNS entries when an integration or SaaS vendor is retired.
3. Least‑privilege DNS management – Restrict edit rights to a core security team; enforce change‑request approvals.
4. Domain squatting protection – Register wildcard subdomains (*.grubhub.com) on a holding page to block unauthorized claims.

Benefits of proactive security monitoring

• Reduced fraud exposure – Early detection can cut potential losses by up to 80 % (according to industry threat‑intel reports).
• Compliance alignment – Maintaining secure DNS hygiene helps satisfy PCI‑DSS and GDPR requirements for data protection.
• Customer trust – Demonstrating swift response to security incidents reinforces merchant confidence in the platform.

Real‑world example: Anonymous restaurant chain case study

• Profile: A regional chain of 12 locations using Grubhub for delivery and in‑store pickup.
• Incident: Received a fake invoice for $7,850 in Bitcoin on Dec 19.
• Response:

1. Contacted Grubhub support and froze the account.
2. Conducted an internal audit of all email communications.

3 . Implemented MFA and updated employee phishing training.

• Outcome: Recovered 30 % of the funds through a blockchain tracing service; the remaining loss was mitigated by insurance coverage.

Practical tips for Grubhub and similar platforms

• Implement subdomain monitoring – Use tools like Detectify or Subjack to scan for orphaned DNS entries continuously.
• Enforce SSL/TLS on every subdomain – Deploy wildcard certificates and HSTS to prevent man‑in‑the‑middle attacks.
• Publish a clear security notice – Provide merchants with step‑by‑step verification guides and a dedicated “phishing report” contact form.
• Reward responsible disclosure – Expand the bug‑bounty program to cover subdomain takeover vectors, encouraging security researchers to report findings before attackers exploit them.

---

Published on archyde.com | 2025‑12‑27 01:57:45