Attackers Abuse Legitimate Platforms to Deliver Phishing Emails That Pass Authentication Checks
Help Net Security, Thursday, October 22nd, 2026
Cisco Talos shows attackers planting callback numbers in real Dell and Staples order emails that pass DKIM and DMARC, plus other platform abuse.
Cisco Talos says attackers have abused more than 25 legitimate platforms over the past year, including collaboration, file-sharing, survey, payment and AI services, feeding them hostile input and letting them deliver it.
In two campaigns of roughly 1,400 messages, attackers planted fake support phone numbers in billing and shipping fields of Dell and Staples orders, so genuine transactional emails that pass DKIM and DMARC carried a callback-scam hook aimed at moving victims to the phone.
List bombing, normally a distraction tactic, is also being repurposed to deliver malicious content.
Because the mail comes from trusted senders, sender authentication offers no protection against these techniques.