Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers

Cisco Talos identified a growing trend where attackers abuse legitimate infrastructure, such as order notification systems from Staples and Dell, to deliver malicious content by injecting attacker-controlled phone numbers into transactional email fields. These messages leverage trusted domains and pass standard email authentication (DKIM, DMARC), making them appear legitimate while creating urgency around fake high-value purchases to prompt victims to call malicious helplines. The same abuse pattern extends to list bombing and bounce abuse, where malicious content is reflected through trusted platforms or embedded in delivery status notifications, bypassing traditional security controls by exploiting trust in legitimate services.

AI-extracted · verify before operational use