# Attackers Abuse Legitimate Infrastructure (Staples, Dell Notification Pipelines) to Distribute Phishing Emails

> Attackers have abused more than 25 legitimate platforms (collaboration, productivity, file-sharing, survey, payment and AI-related services) to deliver phishing content inside system-generated emails that pass DKIM/DMARC. Two campaigns abusing Staples and Dell order notifications accounted for roughly 1,400 messages, injecting attacker-controlled text and phone numbers into shipping-information fields to push recipients into calling the attacker.

- **Published:** 2026-10-28T01:15:12Z
- **Last reviewed:** 2026-10-28T01:15:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4585
- **ID:** TL-2026-4585
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos ("Parasitizing Trust", 2026-10-21) and KnowBe4 (2026-10-27) describe a class of phishing in which the attacker never compromises the abused brand. Instead, the attacker supplies hostile strings to user-controlled fields (order Ship To / Bill To / support fields, registration, profile and project-name forms) and the platform's own transactional pipeline renders and sends the content from its legitimate, authenticated sending infrastructure. Because the messages originate from trusted domains and pass SPF/DKIM/DMARC, reputation-based and authentication-based filtering is weakened.

Two order-notification campaigns were detailed. The Staples campaign used sender support@orders.staples.com with the subject "Here's your Staples order #9939818875. Thanks for shopping with us.", an Apple iPad lure and the callback number 806-283-7712. The Dell campaign used the sender display name "Dell | Order Received" with the subject "We have your order | Dell Purchase ID: 2009829958247", a Microsoft Project Standard 2024 ($736.09) lure and the callback number 808-232-6397. Both passed DKIM/DMARC; combined, about 1,400 messages were observed. Some messages traversed Proton Mail and Microsoft 365 forwarding paths. The objective is to create urgency around a high-value purchase and drive the recipient to call an attacker-controlled phone number (callback / telephone-oriented phishing). The retailers themselves were not compromised.

Talos also describes related abuse vectors: list bombing, in which hostile strings (e.g. cryptocurrency-themed lures) are submitted to public registration forms lacking input validation and are reflected into automated welcome/verification/notification emails; and bounce abuse, in which malicious content is embedded in delivery status notifications (DSNs). An earlier Talos report (2026-04-07, "Weaponizing SaaS notification pipelines") documented abuse of GitHub (scam content in commit messages triggering notifications; spam peaked at 2.89% of daily GitHub traffic on 2026-02-17) and Jira Service Management (deceptive project names and welcome messages sent via the Invite Customers feature).

The sources state no CVE, CVSS score, named threat actor, malware, IP addresses, or file hashes; severity is analyst-assigned. Detection should treat sender trust and content trust as separate signals: validate user-controlled values before rendering in templates, reject unexpected phone numbers and URLs in transactional fields, apply recursive MIME inspection to delivery reports, and correlate notification content with account history and payment state.

## MITRE ATT&CK

- T1566 Phishing
- T1566.004 Phishing: Spearphishing Voice
- T1684.001 Impersonation
- T1036 Masquerading
- T1583.006 Acquire Infrastructure: Web Services
- T1585 Establish Accounts
- T1598.004 Phishing for Information: Spearphishing Voice
- T1204 User Execution

## Sources

- [Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails (KnowBe4)](https://blog.knowbe4.com/attackers-abuse-legitimate-infrastructure-to-distribute-phishing-emails)
- [Parasitizing Trust: How Legitimate Infrastructure Becomes a Delivery Pipeline for Attackers (Cisco Talos)](https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/)
- [Weaponizing SaaS notification pipelines (Cisco Talos)](https://blog.talosintelligence.com/weaponizing-saas-notification-pipelines/)
- [Talos IOCs: weaponizing-saas-notification-pipelines](https://github.com/Cisco-Talos/IOCs/blob/main/2026/04/weaponizing-saas-notification-pipelines.txt)
- [Talos Takes: The trust paradox - how attackers weaponize legitimate SaaS platforms](https://talostakes.talosintelligence.com/2018149/episodes/19135351-the-trust-paradox-how-attackers-weaponize-legitimate-saas-platforms)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4585