The Rise of Email Bombing and IT Impersonation

Your inbox suddenly floods with messages, and you can’t get anything done. Then someone from IT reaches out, offering to help. You’re relieved, so you don’t think twice. It’s a growing category of attack, and it sidesteps the warning signs most employees have been trained to catch, like the mismatched sender address, the urgent request or the link that doesn’t quite look right. The attacker is counting on trust: when help arrives right as you need it, you’re less likely to question it.

What Is Email Bombing?

Email bombing is flooding a target's inbox with thousands of spam messages in a very short timeframe. The goal is to create a sense of disorientation, panic and an urgency for someone to fix it. When hundreds or thousands of messages arrive simultaneously, the inbox becomes impossible to navigate, legitimate communications get buried and the recipient is left overwhelmed and unable to work. The flood of spam is the setup for what comes next.

The Follow-Up: IT Impersonation via Microsoft Teams

An overwhelmed employee who cannot access their inbox will almost always submit a helpdesk ticket. Attackers anticipate this and move faster.

Before any legitimate IT response arrives, the attacker reaches out through Microsoft Teams, posing as IT support and offering to resolve the issue. The timing feels natural, and the context aligns.

The attacker has often done the research, too. Using LinkedIn, they identify real employee names, titles and organizational structures, so the impersonation holds up under scrutiny.

This is social engineering at its most calculated, exploiting a predictable human response to a manufactured crisis.

The Endgame: Remote Access Tools as a Weapon

Once the attacker has established credibility, the ask is straightforward: download a tool to help IT fix the problem remotely. Applications like AnyDesk or Microsoft Quick Assist are legitimate remote administration tools, and their legitimacy is exactly what makes them useful as a delivery mechanism for this attack. The moment that software is installed and access is granted, the attacker has full visibility into the victim's environment, including files, credentials, systems and any sensitive data within reach. The attack that started with a flooded inbox ends with a complete compromise of the victim's technology.

How Organizations Can Prevent It

Stopping this kind of attack takes both the right procedure and the right technical controls. Employees should be trained to verify any unsolicited IT outreach through an official out-of-band channel, like a phone number or contact method already on file and not one provided in the chat.

Organizations should establish and consistently communicate a clear protocol: legitimate IT support will never ask someone to download third-party software to resolve a spam or email issue. An unsolicited Teams message from someone claiming to be IT, particularly one that arrives following unusual inbox activity, should be treated as a red alert and reported before any action is taken.

The Bigger Picture

Research consistently shows that 95% of security breaches involve human error,¹ and attacks like this one succeed by turning a normal response to a stressful situation against them. A well-trained employee who recognizes phishing can still fall victim to a scenario engineered to feel like a rescue operation. Security awareness training is the first and most important line of defense, and its value rises when organizations treat it as an ongoing practice that keeps pace with evolving threats.

Join isolved's cybersecurity team at the upcoming webinar, From Risk to Readiness: Cybersecurity Awareness, on October 21 at 1:00 p.m. ET.

_{1 World Economic Forum, Global Risks Report 2022}