Inbox flooded with sign-up messages? Email bombing explained

Email bombing floods inboxes with signup mail to hide fraud alerts or enable fake tech-support scams.

ESET explains email bombing, also called form, list, or subscription bombing, in which attackers use bots to sign a victim’s address up to hundreds or thousands of legitimate newsletters and services. The resulting inbox flood is meant to hide genuine alerts, such as a bank warning about a fraudulent purchase or a password-reset notice after account takeover. Scammers may then call posing as tech support and push remote-access software to steal browser-stored passwords or install malware. In companies, the same tactic can distract security teams during business-email compromise or invoice fraud, or serve as a precursor to fake IT help-desk access by ransomware affiliates.