Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks

A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should be, sits the word “Helpline” and a phone number – the hook for a callback scam.

The email looks genuine because it is. The attacker supplied only that number, and Dell’s own system put it there and sent the email.

Turning legitimate platforms into couriers

Over the past year, Cisco Talos says, attackers have abused more than 25 legitimate platforms, spanning collaboration, file-sharing, survey, payment and AI services. The attackers feed these platforms hostile input and let them do the delivery.

Cisco’s researchers described three versions of this technique.

In two campaigns totaling roughly 1,400 messages, attackers abused Staples and Dell transactional mail. They planted fake support numbers in the billing and shipping fields of high-value order confirmations (an iPad, in the Staples case). The goal isn’t a click but a phone call, which moves the victim off email entirely.

List bombing is a traditional denial-of-service or distraction tactic that, in a subset of cases, is being repurposed to deliver malicious content. The attacker submits victims’ email addresses to legitimate registration, subscription or notification workflows, and the victims are bombarded with automated confirmation emails.

Some of them, as Cisco researchers noted, carry a lure typed into the name, company, or title field of a poorly validated form. The platform’s welcome email then delivers it, making it look like official platform mail.

Failed delivery notifications (aka “bounced email”) can echo the original message back to the sender and, whether through backscatter from a forged envelope sender or a deliberately triggered failure, an attacker can make a bounce carry a malicious payload.

In one case Talos observed, a mail delivery failure notice carried a WeTransfer-themed file-sharing lure:

The bounced email delivers a file-sharing lure (Source: Cisco Talos)

“The attacker’s goal was to make the phishing lure feel less like an unsolicited external message and more like part of a technical delivery failure that required review. Users are conditioned to view system errors as benign and are far more likely to engage with an ‘administrative’ fix than a suspicious, standalone phishing email,” the researchers explained.

Authenticated isn’t the same as safe

Email authentication was built to answer one question: did this message come from where it claims? SPF, DKIM and DMARC answer it well, but they say nothing about what the sending system was told to say.

That gap offers an attack surface. Any field a user controls and a platform later renders into an email can become a channel. The attacker supplies the content, and the trusted system supplies the reputation, the template and the passing headers.

We should all be careful with any email we receive, but it’s the platform owners who should validate user-controlled values before storing and rendering them.

“Phone numbers, URLs, markup, line breaks, and urgent support language should be rejected or flagged when they appear in fields where they do not belong,” Cisco Talos advised.

Meanwhile, security gateways should inspect the fully rendered message – including HTML, text, URLs, redirects, attachments, personalization fields, and nested MIME content – and not just the sender and the template.

Talos also recommends checking whether transactional mail fits the process that generated it. A receipt with an unexpected support number, cancellation instructions or urgent language should raise flags.

“For delivery reports, recursive MIME inspection is especially important. Gateways should parse DSN containers, extract returned messages or message fragments, and apply normal phishing, malware, and URL analysis to the nested content. A bounce should explain a delivery failure, not provide a blind path for untrusted payloads,” the researchers added.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!