Email Bombing Attacks Hide Fraudulent Purchases and Account Takeovers

ESET Research published findings explaining email bombing, a tactic where attackers flood a victim’s inbox with automated sign-up messages to conceal more serious fraud. This technique, also known as form bombing or list bombing, relies on legitimate services to bypass spam filters.

In a September case involving a Virginia woman, hundreds of newsletters and promotions arrived in 24 hours. These messages were not ordinary spam but a deliberate effort to bury a bank warning about a fraudulent laptop purchase. This pattern indicates that an inbox blitz is often a sign that identity or accounts have been hijacked.

How the Attack Works

Attackers obtain email addresses from historic data breaches, marketing databases, online leaks, or prior phishing attacks. They then use bot-powered tools to register the victim’s address for hundreds of legitimate online services. These include newsletters, subscriptions, mailing lists, free trials, and competitions. Each service generates a welcome email, creating an overflow that standard spam filters often allow through.

The main objective is distraction. Scammers create a smokescreen to prevent victims from seeing genuine emails. These hidden messages may include notifications of account hijacking, password resets, or invoices for fraudulent purchases made in the victim’s name. By burying these alerts, attackers hope the victim will not notice the compromise in time to stop it.

Corporate and Secondary Risks

In corporate environments, bombers aim to distract cybersecurity teams from serious incidents like data breaches or business email compromise. They may also disrupt operations as leverage for extortion. Ransomware affiliates have used email bombing as a precursor to fake IT help desk contacts. This allows them to gain remote access to systems. Alternatively, disgruntled employees or former workers may use this method to cause operational disruption.

Attackers may also contact victims directly, pretending to be tech support engineers. They claim to solve the email problem in exchange for a fee or by tricking the victim into installing remote access software. This grants them access to sensitive information, such as browser-stored passwords, or allows them to install additional malware on the machine.

What should you do?

ESET Research advises against trying to unsubscribe from all random services immediately. Instead, focus on finding the threat the attacker wanted to hide. Search for security alerts, new device sign-ins, email or phone number changes, password resets, or purchases. Check both the inbox and spam folder, as legitimate warnings may end up in either location.

If no immediate issue is visible, check sensitive accounts individually for suspicious activity. Look for new devices or payment methods, changed passwords, or altered recovery details. Also review email forwarding rules and sent or deleted items folders for unusual entries. If something unusual is found, change the password to a unique, strong credential and enable two-factor authentication. Ensure the correct recovery contact information is listed and contact the company if fraud is suspected.

What to do and how to stay safe: ESET

• Search your inbox and spam folder for security alerts, password change notifications, or invoices from unknown merchants.
• Review account settings for unauthorized changes to recovery emails, phone numbers, or forwarding rules.
• Change passwords to unique, strong credentials and enable two-factor authentication on compromised or sensitive accounts.
• Contact service providers directly if you suspect fraudulent purchases or unauthorized account access.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is email bombing?

Email bombing is an attack where bots sign a victim up for hundreds of legitimate services to flood their inbox and hide important security notifications.

Why do attackers use this method?

Attackers use it to distract victims from seeing alerts about account hijacking, password resets, or fraudulent purchases, and sometimes to trick them into contacting fake tech support.

How can I tell if I am a target?

You may notice a sudden influx of welcome emails from services you did not join, which could indicate an attacker is trying to bury a legitimate security alert.