ESET Research: Email Bombing Used to Hide Fraud and Extortion Attempts
Attackers flood inboxes with automated sign-up messages to bury fraud alerts, enabling account takeovers and corporate extortion schemes.
Key points
- Email bombing uses bots to generate hundreds of legitimate service sign-ups that bypass spam filters.
- The volume of messages aims to hide genuine security alerts, password resets, or fraudulent purchase invoices.
- Corporate targets may face operational disruption or extortion leverage alongside hidden account compromises.
ESET Research reports that a sudden influx of automated sign-up emails often signals serious fraud rather than simple spam. Attackers use bot-driven tools to register victims for numerous legitimate services, generating welcome messages that typically evade standard spam filters. This tactic creates an inbox overflow designed to obscure critical communications.
What is the operational impact of email bombing?
The primary goal is distraction. Attackers bury legitimate notifications, such as password reset confirmations or fraudulent purchase invoices, within a sea of automated messages. In corporate environments, this can distract cybersecurity teams from active breaches, business email compromise attempts, or invoice fraud. The noise prevents staff from detecting and responding to the underlying malicious activity in a timely manner.
How do attackers execute these campaigns?
Per ESET Research, attackers first acquire email addresses from historic data breaches, marketing databases, online leaks, or prior phishing campaigns. They then deploy automated tools to sign up for hundreds of legitimate online services, including newsletters, free trials, and competitions. Because these services are real, their confirmation emails are rarely blocked by security filters, ensuring the victim’s inbox becomes unmanageable.
What secondary risks follow the initial flood?
Beyond hiding fraud, attackers may contact victims posing as tech support to resolve the email issue. They might request payment or trick users into installing remote access software. This grants attackers access to sensitive browser-stored passwords or allows malware installation. Ransomware affiliates have also used this method as a precursor to fake IT help desk contacts to gain remote system access.
Questions to ask your suppliers
Organizations should verify whether their vendors monitor for anomalous sign-up volumes across customer accounts. Teams usually check if suppliers have automated alerts for sudden spikes in registration attempts from single email addresses. Determine if your supplier’s incident response plan includes procedures for identifying buried security notifications amidst noise. Ensure your IT operations team and security analysts are briefed on recognizing these patterns as potential precursors to extortion or account takeover attempts.
Background: Phishing
This checklist provides actionable technical controls to stop phishing. It covers email authentication, identity hardening, and endpoint detection. Implement these measures to reduce reliance on user training and close common infrastructure vulnerabilities that attackers exploit.
Read the full guide: Phishing Prevention Checklist for Technical Defenses
What to do and how to stay safe: ESET Research
- Search inboxes and spam folders for security alerts, new device sign-ins, or password change notifications.
- Review sensitive accounts individually for unauthorized payment methods, altered recovery details, or new devices.
- Check email forwarding rules and sent/deleted items folders for unusual activity or configuration changes.
- Contact service providers directly if fraud is suspected, and enforce strong, unique passwords with two-factor authentication.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do attackers use legitimate services for email bombing?
Legitimate service welcome emails are rarely blocked by spam filters, ensuring they reach the victim's inbox to create maximum distraction.
Can email bombing target corporate environments?
Yes, attackers may use it to distract security teams from breaches or disrupt operations as leverage for extortion demands.
What should I check if my inbox is flooded?
Look for hidden security alerts, password resets, device sign-ins, and fraudulent purchases, and verify account recovery settings.
