Email Bombing: Bot-Driven Sign-Ups Bury Fraud Alerts and Enable Corporate Extortion

The short version

• Automated tools sign up victims for numerous legitimate services to generate a flood of welcome emails that bypass standard spam filters.
• This noise is designed to hide genuine notifications regarding account compromises, password changes, or unauthorized financial transactions.
• In business environments, the tactic can distract security teams from serious breaches or serve as a precursor to social engineering and ransomware attacks.

The details

According to ESET Research, email bombing attacks often begin after attackers obtain an email address through historic data breaches, marketing databases, or phishing campaigns. Once the address is secured, attackers deploy bot-powered tools to register the victim for hundreds of legitimate online services. These registrations include newsletters, free trials, competitions, and mailing lists. Because the resulting welcome emails originate from legitimate sources, they typically evade spam filters and overflow the recipient's inbox.

The sheer volume of messages creates a smokescreen. ESET notes that attackers use this distraction to prevent victims from seeing critical alerts. For example, if a hacker hijacks an account and resets the password, the victim receives a notification. By flooding the inbox simultaneously, the attacker hopes the victim misses the security alert among the clutter. Similarly, fraudulent purchases made in the victim's name generate invoices that can be easily overlooked.

In corporate scenarios, the stakes are higher. ESET explains that bombers may target organizations to distract cybersecurity teams from active data breaches, business email compromise schemes, or invoice fraud. Alternatively, the disruption itself may serve as leverage for extortion. Ransomware affiliates have used this method to create chaos, then contact the victim posing as IT support. They claim to resolve the email issue but instead request fees or trick the victim into installing remote access software, enabling further malware installation and data theft.

The context

This technique is also known as form bombing, list bombing, or subscription bombing. It differs from traditional spam because the emails are not unsolicited junk; they are legitimate correspondence from services the victim technically signed up for, albeit involuntarily via automation. The reliance on legitimate services makes detection difficult for standard filtering systems, which are tuned to block known malicious senders rather than high volumes of valid marketing emails.

The attack vector highlights the value of email addresses in the underground economy. Attackers do not need to compromise the email account itself to launch the bombing; they only need the address. This makes any exposed email, whether from a recent breach or a public directory, a potential target. The subsequent social engineering phase, where attackers pose as tech support, exploits the victim's confusion and urgency to restore order to their inbox.

What to watch

• Sudden influxes of welcome emails from unfamiliar services, newsletters, or promotional campaigns.
• Missing security alerts, such as password reset confirmations, new device login notifications, or account change verifications.
• Unexpected invoices or purchase confirmations for items not ordered by the account holder.
• Contact from individuals claiming to be IT support offering to resolve the email flooding issue.

What it means for organisations

Teams usually need to verify if email flooding is masking a deeper intrusion. Check whether critical security alerts, such as multi-factor authentication prompts or privilege escalation logs, were missed during the noise. Determine if attackers used the distraction to request remote access or install unauthorized software. Inform the security operations center and incident response team immediately. Review all accounts for unauthorized changes, including forwarding rules and added recovery methods. Assess supplier risk by checking if partners received similar campaigns, which could indicate a broader data leak affecting your supply chain.

Background: Supply chain attacks

A supply chain attack targets the software or hardware you use before it reaches you. By compromising a trusted vendor, attackers insert malicious code that installs automatically on your systems when you update or deploy the product. This bypasses perimeter defenses because the malicious payload arrives with a valid digital signature.

Read the full guide: Supply Chain Attacks: How Trust Becomes Your Biggest Security Risk

What to do and how to stay safe: ESET

• Search your inbox and spam folder for security alerts, password reset confirmations, or notifications of new device sign-ins that may have been buried.
• Check sensitive accounts individually for suspicious activity, such as new payment methods, altered recovery details, or changed passwords.
• Change passwords to unique, strong credentials and enable two-factor authentication on all compromised or sensitive accounts.
• Verify that your recovery email and phone number are correct to prevent attackers from resetting accounts again.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why do email bombing attacks bypass spam filters?

The emails are legitimate welcome messages from real services, so they are not flagged as malicious spam by standard filters.

How do attackers get the email addresses needed for these attacks?

They obtain addresses from historic data breaches, marketing databases, online leaks, or prior phishing attacks.

What is the ultimate goal of a corporate email bombing attack?

Attackers aim to distract security teams from serious breaches, disrupt operations for extortion, or gain remote access via social engineering.