New Email Attack That Begins with Harmless Spam

Post Date: June 30, 2025

Beware of New Email Attack That Begins with Harmless Spam

Imagine if the spam clogging your inbox wasn’t just a nuisance but the bait for a sophisticated attack.

Everyone can agree email spam is annoying, but it’s ultimately harmless and won’t hurt you or your organization.

However, attackers are weaponizing that harmlessness, hoping to catch you off guard by offering help to get rid of the unwanted messages.

NVISO, a cybersecurity services firm, published an analysis of attackers using spam fatigue tactics to hack Microsoft users.

Hackers send a flood of innocent-looking emails followed by a Teams chat pretending to be a help desk or IT support.

From there, the attackers gain their victims’ trust to steal sensitive data or deploy malicious software.

Let’s break down the steps of the attack and offer tips so you don’t become a victim.

How Does the Email Attack Happen?

Unlike traditional phishing, which relies on tricking users into clicking malicious links, this attack uses more indirect tactics:

The attacker sets up a fake but legitimate-looking Microsoft organization. This makes it easier to appear trustworthy when contacting targets.
They flood the victim’s inbox with subscription spam. These emails clutter the inbox, making it harder to spot legitimate alerts or warnings.
The attacker reaches out via Microsoft Teams. Posing as support, they offer help with the sudden email issue.
They convince the victim to install remote access software. This gives the attacker full control of the device.
Once in, the attacker disables security tools, steals data and can deploy malware

“Unlike traditional phishing, which relies on tricking users into clicking malicious links, this new email attack uses more indirect tactics.”

In a slightly different version of this attack, sometimes a flood of spam emails is meant to mask stolen identities or credit cards.

We recently had a client who had their identity stolen, and the attacker attempted to flood their inbox with messages hoping any correspondence from their bank would go unread.

Luckily, their bank got in contact with them and was able to stop any fraudulent activity.

How Do I Avoid Becoming a Victim?

The emails in this attack aren’t malicious, but the attackers are manipulating you, making you believe they are helping when they are preying on your trust.

There are some things you can do to protect yourself and your organization:

Be wary of Teams messages from people outside your organization. If they claim to be your IT team or manage service provider, contact them another way to confirm it’s them. Note: No one should contact you regarding a spam issue, but most scams only work if the attacker initiates contact.
Disable messages from external users in Teams. If that’s not possible, at the very least only allow specific domains to communicate with your organization.
Set up anti-spam policies that will prevent your mailbox from receiving numerous spam emails.
Never download software. We and other MSPs usually can remote into your devices without you downloading additional software.