Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails
KnowBe4, Tuesday, October 27th, 2026
Cisco Talos research shows attackers abusing trusted platforms and order notifications to deliver phishing that passes authentication checks.
KnowBe4 highlights Cisco Talos research showing a significant rise in phishing campaigns that abuse more than 25 legitimate services, including collaboration, file-sharing, survey, payment and AI platforms.
In two campaigns, attackers inserted malicious text into the shipping fields of genuine Staples and Dell order notifications, sending about 1,400 messages that urged recipients to call attacker-controlled phone numbers.
Neither company was compromised.
Attackers also use list bombing and crafted text in poorly validated form fields so that services send automated emails carrying lures, which pass standard authentication because they come from trusted systems.