Attackers Exploit Zendesk Authentication Issue to Flood Targets’ Inboxes with Corporate Notifications

Attackers are exploiting a gap in Zendesk’s ticket submission process to flood targets’ inboxes with misleading corporate notifications, a tactic that can be triggered when anonymous requests are accepted. When configured to allow anonymous submissions, the system can generate email floods that appear to come from legitimate corporate domains, making it hard to distinguish spam from real ticket notices.

The campaign has seen thousands of rapid-fire alerts aimed at Brian Krebs, with messages claiming to come from well-known brands such as NordVPN, CompTIA, Tinder, The Washington Post, Discord, GMAC, and CapCom, according to KrebsOnSecurity.

Zendesk is investigating and advising customers to adopt authenticated ticket workflows that require email verification before auto-responders are triggered, while organisations are urged to block anonymous ticket creation or require verification steps such as CAPTCHA challenges. Carolyn Camoens, Zendesk’s communications director, explained the workflow risk, noting that some customers accept support requests without prior verification.

The campaign underscores how misconfigured automated support tools can be misused for harassment and brand impersonation, and it was reported on 17 October 2025. According to KrebsOnSecurity, the flood involved messages that bore the branding and reply-to addresses of the customers, further blurring the line between legitimate notifications and spam.