Loading story…
Attackers are abusing unsecured Zendesk support portals to generate a high-volume global email spam wave by submitting large numbers of fake support tickets using victims’ email addresses. Because many Zendesk implementations allow unverified users to open tickets, the platform automatically sends ticket-confirmation emails to the supplied address, effectively turning legitimate customer-support workflows into a mass-mailing mechanism. Recipients reported receiving hundreds of emails with strange, alarming, and sometimes Unicode-styled subject lines; reporting indicates the activity began around January 18 and, in observed samples, the messages generally did not include obvious malicious links or classic phishing lures.
Multiple organizations’ Zendesk instances were observed as sources of the automated emails, including Discord, Tinder, Riot Games, Dropbox, CD Projekt, NordVPN, and Tennessee state agencies, among others. The operational impact is primarily email flooding and user confusion (and potential downstream helpdesk/social-engineering risk), rather than direct malware delivery, with attackers iterating through large address lists to trigger automated confirmations at scale.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Zendesk said it introduced new safety features, including monitoring and limits, to identify and block this relay-spam abuse more quickly. The response came after the large-scale misuse of customer support portals became widely reported.
As the spam wave spread, multiple organizations' Zendesk instances were observed being used to send the messages, and companies including Dropbox and 2K acknowledged the issue. They advised recipients to ignore the unexpected ticket-confirmation emails.
Beginning on January 18, 2026, attackers started submitting large volumes of fake support tickets through unsecured Zendesk-based customer support systems. The abuse triggered hundreds of legitimate-looking confirmation emails to victim email addresses worldwide, causing disruption and confusion.
In a December advisory, Zendesk warned customers that attackers could abuse permissive support portal settings to send spam via ticket confirmation emails. It recommended restricting ticket creation to verified users and removing placeholders that allow arbitrary email addresses and subjects.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourceseclists.org
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have exploited insufficient authentication controls in widely used web-based platforms to launch large-scale spam and email bombing attacks. In one case, attackers abused the customer service platform Zendesk, which allows some customer accounts to accept support requests from anonymous users without prior verification. This configuration enabled malicious actors to generate thousands of ticket creation notifications, which were then sent from the domains of legitimate Zendesk customers such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. The emails, which could contain any subject line chosen by the attacker, included threatening messages and personal insults, and appeared to originate from the customer’s own domain, increasing their credibility and impact. The reply-to addresses in these emails were set to the legitimate support addresses of the affected organizations, further complicating mitigation efforts. Zendesk acknowledged the abuse and stated that while they recommend customers restrict ticket creation to verified users, some organizations opt for anonymous submissions for business reasons, inadvertently exposing themselves to this type of attack. Separately, a massive spam campaign was uncovered on a client’s website due to the misuse of a contact form feature that allowed users to send a copy of their message to themselves. This seemingly innocuous feature was leveraged by attackers to generate 149,700 spam emails, overwhelming the server’s resources and causing significant performance degradation. The investigation revealed that the emails were being generated locally on the server using PHP scripts, with all messages appearing to come from the legitimate website domain. The server’s email queue became saturated, and the high volume of outbound spam led to complaints from recipients and potential blacklisting of the domain. Both incidents highlight the risks associated with allowing unauthenticated or loosely authenticated email submissions in web applications and customer service platforms. Attackers can exploit these features to conduct denial-of-service attacks on inboxes, damage reputations, and disrupt business operations. The technical analysis in both cases pointed to the need for stricter authentication and verification mechanisms for user-submitted forms and support tickets. Organizations are advised to review their platform configurations, disable anonymous submissions where possible, and implement rate limiting and CAPTCHA protections to mitigate abuse. The incidents underscore the importance of balancing user convenience with security controls to prevent exploitation by malicious actors. Failure to secure these features can result in significant operational impact, reputational harm, and increased risk of further compromise. Both cases serve as a warning to organizations using third-party platforms or custom web forms to regularly audit their authentication and submission policies. Proactive monitoring and rapid response to unusual email activity are critical to minimizing the damage from such attacks. The widespread nature of these abuses suggests that many organizations may be unknowingly vulnerable to similar exploitation. Security teams should prioritize the review of all externally facing forms and ticketing systems to ensure robust protections are in place.
Jun 29, 2026
Recent threat activity has highlighted two distinct user-targeted campaigns: mass spam sent from legitimate **Zendesk** domains and a browser-crash social-engineering chain delivering malware. Multiple users reported receiving hundreds of emails originating from real companies’ Zendesk helpdesk instances (including brands such as Live Nation, Capcom, and Tinder), with many messages bypassing common spam filters; the lures included bogus legal notices intended to drive credential theft, initial access, or payment. Zendesk has previously warned about attackers abusing its platform for **relay spam**, and reporting indicated the current wave was not tied to a Zendesk breach or a specific software vulnerability. Separately, Huntress reported a more sophisticated **ClickFix**-style operation dubbed **“CrashFix”** that uses a malicious Chrome Web Store extension (*NexShield*, masquerading as *uBlock Origin Lite*) to intentionally crash the victim’s browser and then present a fake “fix” prompt that advances the infection chain. The campaign was attributed to **KongTuke** and culminates in delivery of a Python-based RAT (**ModeloRAT**), with **domain-joined systems** receiving specially tailored backdoor payloads—raising risk for enterprise environments where browser-based workflows are prevalent. Other items in the set were general-interest content (enterprise browser product comparison, a cyberattacks timeline roundup, and an acquisition announcement) and did not provide additional, specific reporting on these two active campaigns.
Jun 29, 2026
Threat actors associated with the Scattered Lapsus$ Hunters group have launched a sophisticated campaign targeting Zendesk users by creating over 40 typosquatted and impersonation domains designed to mimic legitimate Zendesk portals. These domains are used to harvest credentials through fake single sign-on pages and to submit malicious tickets to real Zendesk helpdesks, potentially delivering remote-access trojans (RATs) to support agents. The attackers' tactics mirror previous campaigns against Salesforce and are believed to be linked to the same criminal crew, with the potential for lateral movement within compromised organizations and theft of sensitive data. The campaign has also been connected to the September 2025 Discord breach, where attackers exploited Discord's Zendesk-based support system to steal user data, including government-issued IDs and billing information. Separately, investigative reporting has identified a 15-year-old in Jordan, known online as "Rey," as a possible key figure in the Scattered Lapsus$ Hunters group. The group, which combines elements of Scattered Spider, Lapsus$, and ShinyHunters, has been implicated in high-profile data thefts from companies such as Salesforce, Toyota, and FedEx. The identification of "Rey" was based on digital footprints and personal information inadvertently revealed in cybercrime forums and Telegram channels. The group has also attempted to recruit insiders at targeted companies, further increasing the threat posed by their operations.
Jun 29, 2026