Threat Actors Use 'Spam Bombing' Technique to Hide Malicious Motives

Darktrace researchers observed a spam-bombing campaign where attackers sign targets up to multiple subscription services to flood inboxes, then pose as IT personnel to lure victims into Microsoft Teams calls; post-call activity included scanning and reconnaissance consistent with network compromise. The report highlights abuse of legitimate platforms (Mandrill/Mailchimp), the dual psychological and technical advantages of email bombing, and recommends user training, verification protocols for IT contacts, and resilient communication channels.