Zendesk Ticket Systems Hijacked: 2026 Relay Spam Disrupts Global Brands
In January 2026, a massive global spam campaign exploited unsecured Zendesk support systems, enabling attackers to send hundreds of unsolicited emails to targets worldwide. By abusing the open ticket submission feature—allowing ticket creation from any email address without verification—attackers automated fake support requests to generate an overwhelming volume of confirmation emails. Major organizations including Discord, Tinder, Riot Games, Dropbox, and government agencies were impacted, with recipients receiving alarming and confusing messages that appeared to originate from legitimate support channels. No malicious payloads were identified, but the incident caused significant alarm, confusion, and business interruption for affected parties. The heightened ability for attackers to manipulate trusted service communications underscores a growing threat of platform abuse, where legitimate systems are turned against users to bypass security controls and sow disruption. With organizations increasingly reliant on third-party SaaS for customer engagement, this incident illustrates how gaps in self-service security can have wide-reaching and highly visible effects.
Kill Chain
