Email Bombs Exploit Lax Authentication in Zendesk
Summary: Cybercriminals are abusing a lack of authentication in Zendesk to flood targeted inboxes with messages sent from hundreds of the platform's corporate customers at once, including CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder. Zendesk communications director Carolyn Camoens said the emails were ticket creation notifications from customer accounts configured to allow anonymous support requests, and that rate limits did not prevent thousands of messages from reaching KrebsOnSecurity's inbox in a few hours.
Bottom line: Zendesk's own rate limits failed to stop thousands of messages in a few hours, and the notifications carried customer domain names and reply-to addresses like help@washpost.com - so the abuse lands on customers' brands, not Zendesk's.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026