Loading story…
Cybercriminals have exploited insufficient authentication controls in widely used web-based platforms to launch large-scale spam and email bombing attacks. In one case, attackers abused the customer service platform Zendesk, which allows some customer accounts to accept support requests from anonymous users without prior verification. This configuration enabled malicious actors to generate thousands of ticket creation notifications, which were then sent from the domains of legitimate Zendesk customers such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. The emails, which could contain any subject line chosen by the attacker, included threatening messages and personal insults, and appeared to originate from the customer’s own domain, increasing their credibility and impact. The reply-to addresses in these emails were set to the legitimate support addresses of the affected organizations, further complicating mitigation efforts. Zendesk acknowledged the abuse and stated that while they recommend customers restrict ticket creation to verified users, some organizations opt for anonymous submissions for business reasons, inadvertently exposing themselves to this type of attack. Separately, a massive spam campaign was uncovered on a client’s website due to the misuse of a contact form feature that allowed users to send a copy of their message to themselves. This seemingly innocuous feature was leveraged by attackers to generate 149,700 spam emails, overwhelming the server’s resources and causing significant performance degradation. The investigation revealed that the emails were being generated locally on the server using PHP scripts, with all messages appearing to come from the legitimate website domain. The server’s email queue became saturated, and the high volume of outbound spam led to complaints from recipients and potential blacklisting of the domain. Both incidents highlight the risks associated with allowing unauthenticated or loosely authenticated email submissions in web applications and customer service platforms. Attackers can exploit these features to conduct denial-of-service attacks on inboxes, damage reputations, and disrupt business operations. The technical analysis in both cases pointed to the need for stricter authentication and verification mechanisms for user-submitted forms and support tickets. Organizations are advised to review their platform configurations, disable anonymous submissions where possible, and implement rate limiting and CAPTCHA protections to mitigate abuse. The incidents underscore the importance of balancing user convenience with security controls to prevent exploitation by malicious actors. Failure to secure these features can result in significant operational impact, reputational harm, and increased risk of further compromise. Both cases serve as a warning to organizations using third-party platforms or custom web forms to regularly audit their authentication and submission policies. Proactive monitoring and rapid response to unusual email activity are critical to minimizing the damage from such attacks. The widespread nature of these abuses suggests that many organizations may be unknowingly vulnerable to similar exploitation. Security teams should prioritize the review of all externally facing forms and ticketing systems to ensure robust protections are in place.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
As an immediate response, administrators stopped email service, suspended the affected user, cleared the mail queue, and disabled the contact form. Recommended follow-up mitigations included removing copy-to-sender features, adding CAPTCHA and rate limits, tightening validation, and improving mail monitoring and controls.
Analysis determined attackers abused a 'Send a copy to yourself' checkbox that let them specify arbitrary external recipients, causing each submission to generate an extra outbound email. The root issue was functional abuse combined with weak or ineffective CAPTCHA, validation, and rate limiting rather than malware or a PHPMailer backdoor.
An incident investigation found a server under extreme CPU load with 149,700 emails queued after attackers abused a website contact form. Mail logs showed the messages were generated locally through PHP/PHPMailer, not through an external SMTP account compromise.
Zendesk said some customers intentionally allow anonymous submissions for business reasons but confirmed this can be abused. The company said it was investigating additional preventive measures and advised customers to require authentication for ticket creation.
Cybercriminals exploited Zendesk customer support instances that allowed anonymous ticket creation to trigger large volumes of notification emails from legitimate customer domains. The abuse sent thousands of harassing or malicious emails to targeted inboxes and exposed weaknesses in Zendesk rate limiting and email validation practices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are abusing **unsecured Zendesk support portals** to generate a high-volume global email spam wave by submitting large numbers of fake support tickets using victims’ email addresses. Because many Zendesk implementations allow **unverified users** to open tickets, the platform automatically sends ticket-confirmation emails to the supplied address, effectively turning legitimate customer-support workflows into a mass-mailing mechanism. Recipients reported receiving **hundreds of emails** with strange, alarming, and sometimes Unicode-styled subject lines; reporting indicates the activity began around **January 18** and, in observed samples, the messages generally did not include obvious malicious links or classic phishing lures. Multiple organizations’ Zendesk instances were observed as sources of the automated emails, including **Discord, Tinder, Riot Games, Dropbox, CD Projekt, NordVPN, and Tennessee state agencies**, among others. The operational impact is primarily **email flooding and user confusion** (and potential downstream helpdesk/social-engineering risk), rather than direct malware delivery, with attackers iterating through large address lists to trigger automated confirmations at scale.
Jun 29, 2026
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026
Threat actors are increasingly abusing **trusted SaaS platforms and email authentication** to deliver high-conviction scam lures that evade traditional filtering. Trend Micro reported a targeted spam operation that weaponizes **Atlassian Cloud** features to send messages that pass common checks (e.g., **SPF/DKIM**) due to the strong reputation of SaaS sender domains; the campaign is multilingual and aims to redirect government and corporate recipients to **fraudulent investment** landing pages using **Keitaro TDS**, with attackers creating multiple Atlassian instances for resilience and scale. Separately, Forcepoint X-Labs described phishing emails impersonating the **US Social Security Administration** that deliver a `.cmd` script to weaken Windows defenses (including disabling **SmartScreen**, removing **Mark-of-the-Web**, and using **Alternate Data Streams**) before silently installing **ConnectWise ScreenConnect** as a remote-access backdoor (including a hardcoded callback configuration). Related research highlighted **DKIM replay attacks**, where adversaries forward legitimate, DKIM-signed vendor emails (e.g., PayPal/DocuSign-style invoices and dispute notices) so the unchanged content continues to validate and can pass **DMARC**, increasing inbox placement and user trust for follow-on social engineering.
Jun 29, 2026