# Phishing campaigns abuse 25+ legitimate platforms (Staples, Dell, WeTransfer) to deliver emails passing DKIM/DMARC

> Cisco Talos reports attackers abusing the transactional, list-registration and bounce (DSN) mail of legitimate platforms so phishing content is delivered from trusted infrastructure and passes email authentication. Over 25 platforms were abused in the past year; two campaigns abusing Staples and Dell order notifications totaled ~1,400 messages.

- **Published:** 2026-10-22T11:22:41Z
- **Last reviewed:** 2026-10-22T11:22:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4137
- **ID:** TL-2026-4137
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos (published 2026-10-21; research acknowledged to Eric Peterson, Dev Shah and Adam Katz, article by Diana Brown) documents three techniques in which attackers do not spoof a sender but instead make a legitimate platform send the malicious content for them. Because the message is generated and signed by the real service, SPF/DKIM/DMARC validate the sending infrastructure and the message lands from a high-reputation source. Authentication answers 'did this message come from where it claims?' but not 'what was the sending system told to say?'. Talos observed this pattern across more than 25 distinct legitimate platforms in the past year, spanning collaboration, productivity, file-sharing, survey, payment and AI-related services. Talos has used the term 'Platform-as-a-Proxy' (PAP) for the broader pattern: threat actors create authentic accounts and use normal platform features 'exactly as they were designed to be used', so the malicious content is wrapped in the platform's official signed email templates. In an earlier Talos Takes episode (2026-05-07) Talos described GitHub (commit summary/description fields used to inject fake billing notifications and fraudulent support numbers) and Jira (deceptive projects with official-sounding names and mass invitations) being abused this way, and stated that about 2.89% of emails observed from GitHub on 2026-02-17 were associated with such campaigns.

Technique 1 - Order/transactional notification abuse: attackers inject attacker-controlled text into fields that retail order workflows reflect into confirmation emails (billing/shipping-type fields). Two campaigns abused Staples (sender support@orders.staples.com, subject 'Here's your Staples order #9939818875. Thanks for shopping with us', fake Apple iPad order, embedded phone number 806-283-7712, DKIM aligned for orders.staples.com, DMARC pass) and Dell (display name 'Dell | Order Received <received@order.dellcom>' as printed by Talos, subject 'We have your order | Dell Purchase ID: 2009829958247', fake item Microsoft Project Standard 2024 at $736.09, embedded phone number 808-232-6397, DKIM passed for Dell infrastructure and DMARC pass reported for order.dell.com). Together the two campaigns totaled about 1,400 messages. The lure is a callback/telephone-oriented scam: the high-value fake order creates urgency so the victim phones the attacker-supplied number for social engineering or payment fraud, rather than clicking a link. Messages were in some cases relayed through intermediaries (Proton Mail, Microsoft 365, enterprise mail infrastructure), which complicates provenance analysis.

Technique 2 - List bombing / registration-field reflection: the victim's address is submitted to many legitimate registration workflows, and hostile strings (e.g. cryptocurrency-themed lures) are placed in poorly validated name, company or title fields. The platform renders those values into official welcome/verification emails, delivering the lure inside routine administrative mail and flooding the inbox. A secondary impact is brand and deliverability damage to the abused platform (complaints and bounces degrading sender reputation and risking blocklisting of legitimate mail).

Technique 3 - Bounce/DSN abuse: attackers cause delivery-status notifications (DSN/NDR) that carry attacker-influenced content. This can be opportunistic backscatter (forging the victim as envelope sender so a failing intermediary returns the original message, lure included) or intentional abuse from an authenticated or compromised sending context. Talos observed a WeTransfer-themed file-sharing lure embedded inside a mail-system failure notification, exploiting users' conditioning to treat system errors as benign.

No CVEs, malware families, named threat actors or C2 infrastructure are cited in the sources. Severity is an analyst judgment. Recommended defenses: platform owners must treat all user-controlled values in email templates as untrusted and reject/flag phone numbers, URLs, markup, line breaks and urgent support language in fields where they do not belong; gateways should inspect fully rendered messages (HTML, text, URLs, personalization fields, nested MIME), recursively parse DSN containers and apply phishing/URL analysis to returned content, and check that content aligns with the workflow that produced it (e.g. unexpected support numbers or cancellation instructions in transactional mail), correlating with account history, payment state and known support channels.

## MITRE ATT&CK

- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1036 Masquerading
- T1667 Email Bombing
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1583.006 Web Services

## Sources

- [Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers](https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/)
- [Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks](https://www.helpnetsecurity.com/2026/10/22/legitimate-platforms-abused-phishing-emails/)
- [Talos Takes: The trust paradox - how attackers weaponize legitimate SaaS platforms](https://talostakes.talosintelligence.com/2018149/episodes/19135351-the-trust-paradox-how-attackers-weaponize-legitimate-saas-platforms)
- [PowerDMARC: Legitimate Infrastructure Abuse - The Phishing Technique That Bypasses Email Authentication](https://powerdmarc.com/legitimate-infrastructure-abuse-phishing/)
- [MITRE ATT&CK T1566.003 Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
- [MITRE ATT&CK T1566.004 Phishing: Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/)
- [MITRE ATT&CK T1667 Email Bombing](https://attack.mitre.org/techniques/T1667/)
- [RFC 3464: An Extensible Message Format for Delivery Status Notifications](https://www.rfc-editor.org/rfc/rfc3464)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4137