Zendesk ticket systems hijacked in massive global spam wave

Zendesk ticket systems have been hijacked in a massive global spam wave, with victims reporting hundreds of emails and alarming subject lines. The wave began on 18 January, and the story was published on 22 January 2026. The emails are generated by support platforms that use Zendesk for customer service, with attackers abusing Zendesk’s ability to allow unverified users to submit support tickets, which then automatically generate confirmation emails sent to the address the attacker entered.

The messages do not appear to contain malicious links or obvious phishing attempts, but the sheer volume and chaotic nature have made them highly confusing and potentially alarming for recipients. According to Bleeping Computer.