{"id":40152,"date":"2021-03-25T10:15:07","date_gmt":"2021-03-25T10:15:07","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/"},"modified":"2021-03-25T10:15:07","modified_gmt":"2021-03-25T10:15:07","slug":"bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/","title":{"rendered":"BP Chargemaster&#8217;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes"},"content":{"rendered":"<p>BP Chargemaster, purveyors of sockets for electric vehicles, seemingly had its email domain hijacked by criminals who used formerly legitimate addresses to send banking trojans to customers.<\/p>\n<p>Malware-laden emails were sent from corporate email addresses earlier this month \u2013 and their attachments included the IcedID credential-stealing malware.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",button,mpu,\" data-sm=\",button,mpu,\" data-md=\",button,banner_plus,mpu\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>It appears that a corporate mail server may have been left unattended after BP Chargemaster <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.theregister.com\/2021\/03\/25\/bp_chargemaster_pulse_rebrand_email_trojan_horror\/\">rebranded as BP Pulse at the start of December 2020<\/a>. During the rebrand, the BP Chargemaster and Polar websites were replaced by bppulse.co.uk, &#8220;to avoid any confusion&#8221;.<\/p>\n<p><i>Register<\/i> reader Matt received some emails from BP Chargemaster which he was certain didn&#8217;t come from the company.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",button,mpu_plusplus,\" data-sm=\",button,mpu_plusplus,\" data-md=\",button,mpu_plusplus,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>&#8220;I last dealt with BP Chargemaster 2 years ago in relation to fitting a chargepoint for an electric car,&#8221; Matt told us, showing us copies of legitimate correspondence with an @bpchargemaster[.]com email address.<\/p>\n<p>Yet when he began hearing from that sender again, the emails he received contained text such as &#8220;Hello. Attached below requires your attention,&#8221; urging Matt to open an attached .zip file. Another read: &#8220;Please look at the file attached. It must be interesting.&#8221; Both messages appeared to have been sent from bpchargemaster[.]com email addresses, and Matt reckoned at the time that they had passed Sender Policy Framework (SPF) validation.<\/p>\n<p>We asked F-Secure to have a look at the malicious attachment sent to Matt and the firm&#8217;s Calvin Gan, senior manager in its Tactical Defence Unit, told <i>The Register<\/i>: &#8220;The email is a malspam campaign spreading a new version of the IcedID banking trojan. The zip file contains a malicious Excel spreadsheet which uses the Excel 4.0 macro feature to hide its code.&#8221;<\/p>\n<p>He added that infosec outfit Binary Defense has a recent <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.binarydefense.com\/icedid-gziploader-analysis\/\">writeup<\/a> of the trojan&#8217;s latest evolution. The company found that when successfully deployed, the trojan dropped Cobalt Strike beacons and crooks then mapped out the network where the nasty had landed, stating: &#8220;IcedID is a formidable threat that makes analysis complex and challenging.&#8221;<\/p>\n<p>It was first uncovered in 2017 by IBM&#8217;s X-Force security division, as we <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2017\/11\/16\/terdot_banking_trojan\/\" rel=\"noopener noreferrer\">reported at the time<\/a>.<\/p>\n<h3 class=\"crosshead\"> <span>Lost control of the domain<\/span><br \/>\n<\/h3>\n<p>BP Chargemaster publicly admitted that it had lost control of the bpchargemaster[.]com domain, although it appears to be showing legitimate BP content at the time of writing. A later message from BP Chargemaster (and not the scammers), forwarded to us by <i>Reg<\/i> reader John said:<\/p>\n<p>BP Chargemaster also advised people receiving those emails not to open them or the attachments and said it had informed the Information Commissioner&#8217;s Office, while it carries out &#8220;a detailed investigation&#8221;.<\/p>\n<p>When asked for comment, a BP Chargemaster spokesman responded with a statement substantially identical to the email sent to customers, and did not elaborate on what had happened inside BP that caused the compromise of its email infrastructure.<\/p>\n<p>F-Secure&#8217;s Gan commented: &#8220;We cannot confirm if BP Chargemaster&#8217;s infrastructure was compromised but it does look like [their] admittance of no longer actively using the mail address indicates that the mail server could be retired or hidden from the public.&#8221;<\/p>\n<p>The incident may have some similarities with one affecting London cloud firm Datrix, whose email systems were nearly used to send &#8220;several thousand&#8221; malicious messages <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2019\/11\/28\/datrix_phishing_attack\/\" rel=\"noopener noreferrer\">after a staffer fat-fingeredly opened a phishing email<\/a> back in 2019.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",button,dbutton,mpu_plus,dmpu,\" data-sm=\",button,dbutton,mpu_plus,dmpu,\" data-md=\",button,dbutton,mpu_plus,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener noreferrer\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>The Information Commissioner&#8217;s Office was informed of the incident. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2021\/03\/25\/bp_chargemaster_pulse_rebrand_email_trojan_horror\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>F-Secure confirms nature of email nasty to El Reg BP Chargemaster, purveyors of sockets for electric vehicles, seemingly had its email domain hijacked by criminals who used formerly legitimate addresses to send banking trojans to customers.\u2026  READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-40152","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>BP Chargemaster&#039;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BP Chargemaster&#039;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-25T10:15:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"BP Chargemaster&#8217;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes\",\"datePublished\":\"2021-03-25T10:15:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/\"},\"wordCount\":571,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/\",\"name\":\"BP Chargemaster's Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2021-03-25T10:15:07+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BP Chargemaster&#8217;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"BP Chargemaster's Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/","og_locale":"en_US","og_type":"article","og_title":"BP Chargemaster's Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-03-25T10:15:07+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"BP Chargemaster&#8217;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes","datePublished":"2021-03-25T10:15:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/"},"wordCount":571,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/","url":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/","name":"BP Chargemaster's Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2021-03-25T10:15:07+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2YFyHM0sYLyqYBrA5hBVGbQAAAMI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/bp-chargemasters-pulse-rebrand-let-crims-send-icedid-banking-trojan-from-formerly-legit-mailboxes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"BP Chargemaster&#8217;s Pulse rebrand let crims send IcedID banking trojan from formerly legit mailboxes"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=40152"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/40152\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=40152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=40152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=40152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}