Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers

Cisco Talos research identifies a growing trend where attackers exploit legitimate infrastructure, including transactional email pipelines from retailers such as Staples and Dell, to deliver malicious content. The attacks do not rely on forged sender identities but instead inject attacker-controlled data into fields of legitimate order notifications, such as shipping or billing information, to create a convincing narrative of an unauthorized high-value purchase. The goal is to induce recipients to call attacker-controlled phone numbers, enabling further social engineering or fraud. These messages pass SPF, DKIM, and DMARC authentication, reinforcing their perceived legitimacy. This abuse reflects a broader systemic issue where platforms implicitly trust and render unvalidated input from untrusted sources into high-reputation notifications. Additionally, list bombing techniques are evolving from denial-of-service to content delivery by exploiting insufficient input validation in registration and notification workflows across various SaaS platforms.

The impact includes the potential for victims to be socially engineered via phone calls initiated from trusted-looking order notifications, leading to payment fraud, credential theft, or remote assistance scams. The abuse of authenticated, legitimate infrastructure undermines trust in transactional communications and complicates detection and prevention efforts. Organizations relying on these notification pipelines may inadvertently facilitate attacker-controlled interactions, increasing the risk of financial and data loss.

Retailers and platform operators should implement strict validation of all input fields that are reflected in transactional notifications, rejecting or flagging unexpected phone numbers, URLs, or urgency language in fields where they do not belong. Correlate order notification content with account history, payment status, and known support channels to detect anomalies. Treat order notifications as sensitive content and apply business logic checks beyond sender authentication to verify transaction legitimacy. Security teams should be aware that SPF, DKIM, and DMARC passing does not guarantee the authenticity of the transaction details or embedded contact information. User education on verifying unexpected order notifications and cautious handling of unsolicited calls is also recommended.