Email bombing and subscription bombing: what it is and how to respond

An inbox that suddenly fills with hundreds of newsletter confirmations is not just an annoyance. Security agencies have documented these floods being used to hide fraud and to open the door for fake IT support calls. This guide explains how email bombing works, what to do in the first hour, and how to prepare your team.

What is email bombing?

Email bombing is sending so much mail to one address, so quickly, that the person can't find or act on the messages that matter. The most common form today is subscription bombing: an attacker enters the victim's address into hundreds of website forms, newsletters and account sign-ups.

Microsoft describes mail bombing as "a distributed denial of service (DDoS) attack that typically subscribes recipients to a large number of legitimate newsletters and services." It says the volume of incoming mail "within minutes intends to overwhelm the recipient's mailbox and email security systems, and acts as a precursor to malware, ransomware, or data exfiltration" (Microsoft Learn).

That last part matters. The flood is rarely the attack itself.

Why do attackers flood an inbox?

To hide a real alert

Switzerland's National Cyber Security Centre calls subscription bombing "a targeted distraction tactic used by cybercriminals." In the cases it describes, the attacker has already taken over one of the victim's accounts and triggers a transaction. "The security alert or confirmation email from the affected service is then buried in a flood of emails" (Swiss NCSC, February 2026).

The hidden message might be a password change notice, a new-device sign-in alert, an order confirmation or a payment receipt.

To set up a fake help-desk call

In May 2024, Microsoft Threat Intelligence reported a group it tracks as Storm-1811 using floods as the first step toward ransomware. The group signed targets up to "multiple email subscription services." Then, "following the email flood, the threat actor impersonates IT support through phone calls to the target user," offering to fix the spam problem (Microsoft Security Blog).

During the call, the victim was persuaded to open Quick Assist, Windows' built-in remote support tool, and hand over control. Microsoft reports the group later also contacted targets through Microsoft Teams, using display names such as "Help Desk" and "IT Support." The intrusion led to Black Basta ransomware.

CISA, the FBI, HHS and MS-ISAC updated their joint Black Basta advisory on November 8, 2024 to add this technique. It says recent techniques include "email bombing—a tactic used to send a large volume of spam emails—" used "to aid social engineering over Microsoft Teams and trick victim end users into providing initial access" through remote monitoring and management tools (CISA AA24-131A).

Summary of documented patterns

Why is email bombing hard to filter?

Most of the messages aren't spam in the usual sense. They come from real businesses' sign-up forms, so they're typically sent from reputable infrastructure with valid authentication. A single newsletter confirmation looks exactly like one the user requested.

What gives a flood away is the pattern: a sudden spike in volume to one recipient, from many unrelated senders, mostly welcome and confirmation messages. Microsoft says Defender for Office 365 has been able to "detect and classify mail bombing attacks" since June 2025, and it shows "Mail bombing" as a detection technology in its admin tools. Other filters vary, so ask your provider how it handles volume spikes to a single mailbox.

What should you do during an email bomb?

If you're the person being flooded

1. Don't delete everything at once. The Swiss NCSC's advice is "Don't panic and delete everything."
2. Search for the message that matters. Look for words such as "password," "payment," "order" and "security."
3. Check your important accounts directly. Sign in to online banking, card accounts and shopping accounts through the app or a bookmarked address, not links in the flood. Look for new orders, payees, devices or password changes.
4. Don't reply to the flood messages.
5. Report it to IT through your normal channel, even though the messages look legitimate.
6. Refuse unsolicited help. If someone calls or messages on Teams offering to fix the spam, end the contact and reach IT on a number you already know. Never open Quick Assist or another remote tool, read out a code, or approve a sign-in for someone who contacted you first.

If you're the admin

1. Assume the flood may be cover. Check the user's sign-in logs, MFA methods, inbox rules and forwarding for signs of takeover. Our guide to signs an email account is compromised lists where to look.
2. Check the user's other accounts. Ask which bank, payroll, shopping and SaaS accounts use this address, and have the user review them.
3. Contain the flood. Use your filter's per-user rules to send confirmation-style messages to quarantine or junk for that mailbox for a few days, while letting known senders through with an allow list. Review the quarantine instead of deleting it, so a hidden alert isn't lost.
4. Warn the help desk and the user's team. Tell them a fake IT call or Teams chat may follow.
5. Keep evidence. Export a sample of the flood with full headers. The Email Header Analyzer shows the real origin of each message.

How do you prepare your team before it happens?

The flood is noisy. The real damage comes from the quiet call that follows. Preparation is mostly procedure.

Set help-desk rules everyone knows

• Tell staff how IT will contact them, and how it won't. For example: "IT never calls unannounced to fix spam and never asks you to start a remote session."
• Verify in both directions. Users should call IT back on a known number. Help desk staff should verify a caller's identity before resetting passwords or MFA.
• Restrict remote-access tools. Microsoft recommends you "consider blocking or uninstalling Quick Assist and other remote monitoring and management tools" if you don't use them, and remove Quick Assist if you use a different support tool.
• Train people on the External tag in Teams and email. Microsoft advises users to "never share their account information or authorize sign-in requests over chat."

Harden accounts

Use MFA everywhere, phishing-resistant where you can, so a flood can't hide a takeover that never happened. Turn on sign-in and new-device alerts for important accounts.

Make sure your filtering can be tuned per user

During a flood you'll want to quarantine rather than delete, review quickly, and loosen the rules afterwards. A per-user quarantine with digests, like the one described in what an email quarantine is, makes that practical.

How do you stop your own website being used in an attack?

Subscription bombing only works because thousands of websites send email to any address typed into a form. Make sure yours isn't one of them. The Swiss NCSC recommends that website operators:

• Protect newsletter and contact forms with a CAPTCHA.
• Limit sign-ups or contact requests per IP address within a given time.
• "Require CAPTCHA verification before confirmation emails are sent."

Google's sender guidelines also advise confirming each recipient's address before subscribing them. Confirmed opt-in keeps your list clean and protects your own sending reputation; see our email deliverability checklist.

Next steps

1. Agree and publish a one-line rule on how IT contacts staff, and how it never does.
2. Decide whether you need Quick Assist or other remote tools, and remove what you don't use.
3. Add CAPTCHA and rate limits to every form on your website that sends email.
4. Check that your inbound filtering lets you quarantine and review mail per user. iBlockSpam gives every user a personal quarantine with scheduled digests, plus domain-wide allow and block lists.

Browse our other phishing and threat guides.