Simple Mail Transfer Pirates: How threat actors are abusing third-party infrastructure to send spam
Summary: Cisco Talos reports that spammers are abusing legitimate third-party infrastructure - web forms on registration, event and contact pages, and Google tools including Drawings, Sheets, Forms, Calendar, Groups and Quizzes - to send unsolicited email from sources that are not likely to be blocked. Talos also describes credential stuffing against IMAP and outbound SMTP servers, using open-source tools MadCat and MailRip plus custom tools, with test messages identifiable by subject headers such as "You get a new smtp" and "MailRip Test Result."
Key Takeaway: An attacker who logs into your outbound SMTP server as a victim gets a legitimate mail server and domain that real-time blackhole lists are unlikely to block, and Talos notes most form-generated emails are legitimate, so the malicious ones blend into normal traffic.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026