Cisco Talos has published new research that should change how every security and email team reads the words “this message passed authentication”. In a Threat Spotlight titled Parasitizing trust, published on 21 October 2026, the researchers describe how attackers have spent the past year systematically abusing legitimate infrastructure instead of building their own. Talos observed abuse across more than 25 distinct legitimate platforms, spanning collaboration, productivity, file-sharing, survey, payment and AI-related services.
The pattern is the same every time. The attacker does not forge a sender or register a lookalike domain. Instead, they feed hostile input into a trusted platform, and the platform itself renders that input inside a genuine, authenticated, high-reputation notification email.
The Staples and Dell order notification campaigns
Talos analyzed two order notification campaigns that abused the transactional email pipelines of Staples and Dell. Together they accounted for roughly 1,400 messages observed by Talos.
In the first campaign, victims received what looked like a Staples order confirmation from [email protected], confirming a purchase of an Apple iPad, complete with order number, pricing, billing details and standard Staples footer content. The malicious element was hidden in the order fields where shipping and billing information normally sits: a “Helpline” phone number controlled by the attacker. The message headers showed DKIM alignment for orders.staples.com and DMARC passing for the visible Staples domain.
The second campaign used the same pattern with a Dell order notification, confirming a purchase of Microsoft Project Standard 2024 for 736.09 dollars, again with an attacker-controlled “Helpline” number placed in the Ship To and Bill To sections. That message also showed DKIM passing for Dell infrastructure and DMARC passing for order.dell.com.
The goal was never a click on a phishing link. The goal was a phone call. Once the victim moved from email to voice, the attacker could continue with social engineering, payment manipulation, credential theft or remote assistance fraud. Authentication proved the outer message came from real Staples or Dell infrastructure, but said nothing about whether the phone number or the transaction context was legitimate.
List bombing becomes a content delivery vehicle
Talos also describes an evolution in list bombing. Traditionally, attackers flooded a victim’s inbox with automated subscription messages as a distraction or denial-of-service. Talos now observes a subset of cases where attackers type a hostile string, such as a cryptocurrency-themed lure, into public-facing registration forms, name fields, company fields or title fields that lack proper input validation. The platform then reflects that lure into its own automated welcome or verification emails, delivering attacker content inside system-generated mail that passes standard authentication checks.
The researchers also note that mail delivery failure notices are being abused the same way. An attacker can trigger a bounce that carries a malicious payload, for example a file-sharing lure, because users are conditioned to view system errors as benign.
Why this does not mean DMARC is broken
The instinctive reaction to phishing that passes DMARC is to ask whether authentication still matters. Talos is explicit about this: SPF, DKIM and DMARC answer whether a message came from expected infrastructure. They do not answer whether the transaction was legitimate or whether the rendered fields make business sense. Sender authentication is necessary but not sufficient.
That is the right conclusion, and it cuts both ways. For receivers, a passing DMARC check is the floor, not the ceiling: content inspection, callback verification against known support channels and validation of what belongs in a transactional field still matter. For senders, the research is a warning about what happens when authentication is absent. Attackers invest this much effort in borrowing trusted domains precisely because spoofing an unauthenticated domain remains cheap. A domain with a DMARC policy stuck at p=none gives them that cheap option every day.
The deliverability angle for legitimate senders
There is also a lesson for marketers and platform operators. Every field reflected into a transactional message, from shipping name to order note to support field, can become a delivery vehicle if it is not validated before rendering. Brands whose pipelines get abused this way absorb a trust liability that no unsubscribe link can repair. Meanwhile, mailbox providers keep tightening requirements on authenticated, wanted mail, so the senders who invest in full DMARC enforcement are the ones whose legitimate mail stays distinguishable from the noise.
Talos recommends treating order notifications as sensitive content: correlate notification content with account history and payment state, and flag unexpected phone numbers, URLs or urgency language in fields where they do not belong.
The takeaway is simple. Authentication stops domain spoofing, and it is still the control every sender needs at enforcement. But the newest attacker playbooks borrow authenticated infrastructure, so verification has to extend to what the message actually asks the user to do. Excello Mail maps every legitimate sending source for your domains and takes you to full DMARC enforcement without breaking real mail, and its monitoring surfaces the unauthorized senders that try to hide among the legitimate ones. Sign up for free to Excello Mail and make sure your domain is never the mask for someone else’s fraud.