{"id":40932,"date":"2026-09-23T16:00:17","date_gmt":"2026-09-23T14:00:17","guid":{"rendered":"https:\/\/www.retarus.com\/blog\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/"},"modified":"2026-09-25T15:13:08","modified_gmt":"2026-09-25T13:13:08","slug":"overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering","status":"publish","type":"post","link":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/","title":{"rendered":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Our <a href=\"https:\/\/www.retarus.com\/products\/email-security\/\">email security<\/a> experts are currently noting an increase in a particularly devious multi-vector attack. First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. This is soon followed by contact from a person claiming to belong to IT support \u2013 often via Microsoft Teams \u2013 who then attempts to trick the user into revealing their login credentials \/ MFA codes or installing a remote access tool.<\/p>\n\n\n\n<h2 id=\"h-here-s-how-the-attack-proceeds\" class=\"wp-block-heading\">Here\u2019s how the attack proceeds<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers bombard email accounts with newsletter subscriptions, automated notifications, or other messages that are essentially harmless. These emails are primarily sent via transactional email services using various sender-recipient combinations. They also utilize a number of different subdomains and \u201cplus addresses\u201d. This creates a multitude of distinct sending patterns, making it difficult for conventional security filters to identify the messages as belonging to a wave of attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From a purely technical standpoint, the individual emails are generally no cause for alarm. They are properly authenticated, don&#8217;t contain any harmful links or attachments, and tend not to display the typical characteristics of a phishing email. For the algorithms that typically evaluate messages individually, the actual intent behind them is thus largely well concealed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aiming to take advantage of the bewilderment caused by the flooded inbox, the attackers then contact the victim (for instance, via an external Microsoft Teams call or chat), posing as internal IT support and offering their \u201chelp\u201d.<\/p>\n\n\n\n<h2 id=\"h-why-classic-spam-protection-is-not-enough-on-its-own-nbsp\" class=\"wp-block-heading\">Why classic spam protection is not enough on its own&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cInbox bombing\u201d deviously combines several channels in a single attack. Effective protection therefore requires a combination of maximum email traffic transparency, rapid forensic analysis, and the ability to respond instantly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s why Retarus Email Security tackles the attack chain at multiple points. Firstly, the company\u2019s various <a href=\"https:\/\/www.retarus.com\/products\/email-security\/advanced-threat-protection\/\"><strong>anti-spam and anti-phishing filters<\/strong><\/a> significantly reduce the likelihood that suspicious or malicious content will end up in a user\u2019s inbox. In addition, <a href=\"https:\/\/docs.retarus.com\/seg\/secure-email-gateway-description#DHA-Protection\"><strong>Directory Harvest Attach (DHA) Protection<\/strong><\/a> impedes the attackers\u2019 ability to harvest personal email addresses. Finally, <a href=\"https:\/\/docs.retarus.com\/seg\/secure-email-gateway-description#Backscatter-Protection\"><strong>Backscatter Protection<\/strong><\/a> prevents the attack from being amplified by automated response messages.<\/p>\n\n\n\n<h2 id=\"h-maximum-data-transparency-makes-anomalies-visible\" class=\"wp-block-heading\">Maximum data transparency makes anomalies visible<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As long as the individual messages are properly authenticated and contain no malicious links or attachments, this type of inbox-bombing campaign can\u2019t be detected reliably based on content and formatting alone. This is where the high level of transparency offered by Retarus\u2019 services comes into play.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By way of our <a href=\"https:\/\/www.retarus.com\/blog\/en\/new-observability-metrics-for-retarus-email-security\/\"><strong>Observability Metrics<\/strong><\/a>, for example, we grant your security and IT teams real-time insight into security-related data pertaining to your email communication. Changes in incoming volumes, quarantine rates, or authentication errors expose unusual traffic spikes at an early stage. In Prometheus format, this data can be integrated into existing monitoring and observability platforms such as Grafana, Splunk, Dynatrace, or Elastic. In this way, a flood of emails that would otherwise be difficult to interpret becomes a recognizable pattern that can be detected quickly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/docs.retarus.com\/seg\/email-live-search\"><strong>myEAS Email Live Search<\/strong><\/a>, moreover, allows you to search within your email correspondence by sender, IP address, subject line patterns, and time periods.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using <a href=\"https:\/\/docs.retarus.com\/seg\/api-manual-forensic-siem-integration\"><strong>SIEM integration<\/strong><\/a>, the data provided by Retarus can be easily correlated with data from Microsoft Teams, identity management systems, and endpoint systems. This enables security teams to recognize that the \u201cflood of emails\u201d and attempts by external persons to contact users are part of a single, coordinated attack.<\/p>\n\n\n\n<h2 id=\"h-containing-the-wave-of-attacks-quickly-and-effectively\" class=\"wp-block-heading\">Containing the wave of attacks \u2013 quickly and effectively<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As soon as a wave of attacks wave has been identified, the <a href=\"https:\/\/www.retarus.com\/blog\/en\/retarus-expands-administration-api-with-automated-provisioning\/\"><strong>Administration API<\/strong><\/a> facilitates an immediate response. The senders and domains involved can be blocked in real time using inbound restriction lists and anti-spam blocklists (for individual recipients or organization-wide). This gives your SOC team the opportunity to restrict further delivery without having to perform laborious, time-consuming manual configurations.<\/p>\n\n\n\n<h2 id=\"h-retarus-transactional-email-protect-your-outbound-channel-from-misuse\" class=\"wp-block-heading\">Retarus Transactional Email: Protect your outbound channel from misuse<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Although \u201cInbox bombing\u201d specifically targets email inboxes, the cases we\u2019ve observed generally involvethe misuse of email delivery services. However, customers using <a href=\"https:\/\/www.retarus.com\/products\/transactional-email\/\"><strong>Retarus Transactional Email<\/strong><\/a> can rest assured that technical and organizational measures are in place to prevent such attacks from being carried out in their company\u2019s name. These measures include strictly controlled access and sending processes, continuous monitoring of email traffic, and clearly defined procedures for detecting and responding quickly to any form of irregular activity.<\/p>\n\n\n\n<h2 id=\"h-retarus-advises-remain-vigilant-and-react-quickly-to-any-suspicious-activity\" class=\"wp-block-heading\">Retarus advises: Remain vigilant and react quickly to any suspicious activity<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For the time being, keep a close eye on any unusual developments in your email traffic and sudden spikes in inbound volumes. At the same time, remind your employees of the best practices for handling suspicious attempts to contact them. Should you suspect that such an incident may have occurred at your company, <a href=\"https:\/\/www.retarus.com\/contact\/\">please get in touch with our experts straight away<\/a>. In addition to offering technical countermeasures, Retarus Support and our Professional Services teams are always at hand to assist and advise you when it comes to analysis, configuration, integration into existing security processes, and responding to incidents.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.<\/p>\n","protected":false},"author":12,"featured_media":40931,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ret_read_more_text":"","ret_thumb_border":false,"footnotes":""},"categories":[3043],"tags":[43],"ret_content_type":[3071],"class_list":["post-40932","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-email-security","ret_content_type-product-news"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.5 (Yoast SEO v28.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks | Retarus Blog<\/title>\n<meta name=\"description\" content=\"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks\" \/>\n<meta property=\"og:description\" content=\"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/\" \/>\n<meta property=\"og:site_name\" content=\"Retarus Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/retarus\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-23T14:00:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-25T13:13:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"S\u00f6ren Schulte\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@retarus\" \/>\n<meta name=\"twitter:site\" content=\"@retarus\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"S\u00f6ren Schulte\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/\"},\"author\":{\"name\":\"S\u00f6ren Schulte\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#\\\/schema\\\/person\\\/da5eb37e5936738ea4e12be8b429433d\"},\"headline\":\"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks\",\"datePublished\":\"2026-09-23T14:00:17+00:00\",\"dateModified\":\"2026-09-25T13:13:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/\"},\"wordCount\":830,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/09\\\/AdobeStock_2090600923.jpg\",\"keywords\":[\"Email Security\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/\",\"url\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/\",\"name\":\"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks | Retarus Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/09\\\/AdobeStock_2090600923.jpg\",\"datePublished\":\"2026-09-23T14:00:17+00:00\",\"dateModified\":\"2026-09-25T13:13:08+00:00\",\"description\":\"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/09\\\/AdobeStock_2090600923.jpg\",\"contentUrl\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/09\\\/AdobeStock_2090600923.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/\",\"name\":\"Retarus Blog\",\"description\":\"Enterprise Communication &amp; Cybersecurity\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#organization\",\"name\":\"retarus GmbH\",\"alternateName\":\"retarus Inc.\",\"url\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/08\\\/retarus_logo_2025.png\",\"contentUrl\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/41\\\/2026\\\/08\\\/retarus_logo_2025.png\",\"width\":696,\"height\":696,\"caption\":\"retarus GmbH\"},\"image\":{\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/retarus\",\"https:\\\/\\\/x.com\\\/retarus\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/retarus\"],\"telephone\":\"+49 89 5528 0000\",\"foundingDate\":\"1992-12-02\",\"vatID\":\"DE811459192\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.retarus.com\\\/blog\\\/en\\\/#\\\/schema\\\/person\\\/da5eb37e5936738ea4e12be8b429433d\",\"name\":\"S\u00f6ren Schulte\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g\",\"caption\":\"S\u00f6ren Schulte\"},\"jobTitle\":\"Senior Product Marketing Manager Email Security\",\"worksFor\":\"S\u00f6ren Schulte\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks | Retarus Blog","description":"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/","og_locale":"en_US","og_type":"article","og_title":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks","og_description":"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.","og_url":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/","og_site_name":"Retarus Blog","article_publisher":"https:\/\/www.facebook.com\/retarus","article_published_time":"2026-09-23T14:00:17+00:00","article_modified_time":"2026-09-25T13:13:08+00:00","og_image":[{"width":1920,"height":1080,"url":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg","type":"image\/jpeg"}],"author":"S\u00f6ren Schulte","twitter_card":"summary_large_image","twitter_creator":"@retarus","twitter_site":"@retarus","twitter_misc":{"Written by":"S\u00f6ren Schulte","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#article","isPartOf":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/"},"author":{"name":"S\u00f6ren Schulte","@id":"https:\/\/www.retarus.com\/blog\/en\/#\/schema\/person\/da5eb37e5936738ea4e12be8b429433d"},"headline":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks","datePublished":"2026-09-23T14:00:17+00:00","dateModified":"2026-09-25T13:13:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/"},"wordCount":830,"commentCount":0,"publisher":{"@id":"https:\/\/www.retarus.com\/blog\/en\/#organization"},"image":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#primaryimage"},"thumbnailUrl":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg","keywords":["Email Security"],"articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/","url":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/","name":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks | Retarus Blog","isPartOf":{"@id":"https:\/\/www.retarus.com\/blog\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#primaryimage"},"image":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#primaryimage"},"thumbnailUrl":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg","datePublished":"2026-09-23T14:00:17+00:00","dateModified":"2026-09-25T13:13:08+00:00","description":"Our email security experts are currently seeing a particularly insidious combination of attacks: First, cybercriminals flood employees\u2019 personal email inboxes with emails that appear (technically) harmless. Shortly thereafter, a supposed IT support representative contacts the employee\u2014often via Microsoft Teams\u2014with the aim of obtaining login credentials, MFA codes, or convincing the employee to install a remote access tool.","breadcrumb":{"@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#primaryimage","url":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg","contentUrl":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/09\/AdobeStock_2090600923.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/www.retarus.com\/blog\/en\/overflowing-inbox-fake-support-inbox-bombing-as-a-gateway-to-social-engineering\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.retarus.com\/blog\/en\/"},{"@type":"ListItem","position":2,"name":"Flooded Inbox, Bogus Support: \u201cInbox Bombing\u201d Opens the Door for Social Engineering Attacks"}]},{"@type":"WebSite","@id":"https:\/\/www.retarus.com\/blog\/en\/#website","url":"https:\/\/www.retarus.com\/blog\/en\/","name":"Retarus Blog","description":"Enterprise Communication &amp; Cybersecurity","publisher":{"@id":"https:\/\/www.retarus.com\/blog\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.retarus.com\/blog\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.retarus.com\/blog\/en\/#organization","name":"retarus GmbH","alternateName":"retarus Inc.","url":"https:\/\/www.retarus.com\/blog\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.retarus.com\/blog\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/08\/retarus_logo_2025.png","contentUrl":"https:\/\/www.retarus.com\/blog\/wp-content\/uploads\/sites\/41\/2026\/08\/retarus_logo_2025.png","width":696,"height":696,"caption":"retarus GmbH"},"image":{"@id":"https:\/\/www.retarus.com\/blog\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/retarus","https:\/\/x.com\/retarus","https:\/\/www.linkedin.com\/company\/retarus"],"telephone":"+49 89 5528 0000","foundingDate":"1992-12-02","vatID":"DE811459192"},{"@type":"Person","@id":"https:\/\/www.retarus.com\/blog\/en\/#\/schema\/person\/da5eb37e5936738ea4e12be8b429433d","name":"S\u00f6ren Schulte","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8fa38c350b57c73da12ffeeff1b01002222aedd590e6e179dd879e00479633df?s=96&d=mm&r=g","caption":"S\u00f6ren Schulte"},"jobTitle":"Senior Product Marketing Manager Email Security","worksFor":"S\u00f6ren Schulte"}]}},"_links":{"self":[{"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/posts\/40932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/comments?post=40932"}],"version-history":[{"count":3,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/posts\/40932\/revisions"}],"predecessor-version":[{"id":40936,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/posts\/40932\/revisions\/40936"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/media\/40931"}],"wp:attachment":[{"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/media?parent=40932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/categories?post=40932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/tags?post=40932"},{"taxonomy":"ret_content_type","embeddable":true,"href":"https:\/\/www.retarus.com\/blog\/en\/wp-json\/wp\/v2\/ret_content_type?post=40932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}