8,000+ Domains of Trusted Brands Hijacked for Massive Spam Operation

Guardio Labs details the SubdoMailing campaign operated by a group dubbed “ResurrecAds,” which has hijacked over 8,000 domains and 13,000 subdomains (including strong brand names) since at least September 2022 to distribute millions of image-based spam and phishing emails daily; the actors use CNAME takeovers, DNS/SPF/DKIM/DMARC manipulation, residential IPs and extensive redirect chains to bypass detection, monetize clicks, and route victims to targeted scams, ads or potential malware, and Guardio provides a SubdoMailing Checker to help detect compromises.