Email bombing
Email bombing is the deliberate flooding of an inbox with a large volume of messages, disrupting normal use and sometimes creating a pretext for a follow-up scam.
The flood can make a fake helper convincing
An inbox suddenly fills with newsletters, registration messages, and subscription confirmations. One way attackers create this flood is by submitting the target’s address to many subscription services. The messages may come from real services even though the recipient never requested them.
Microsoft documented Storm-1811 using email flooding before calls that impersonated IT support. The caller offered to fix the spam problem, then sought remote access. The November 2024 joint Black Basta advisory also describes flooding followed by support impersonation over calls or Microsoft Teams.
The flood does not prove that the mailbox password was stolen, and it does not identify the attacker on its own. But an unexpected offer to fix it deserves scrutiny, especially if the caller wants you to start a remote session.
Get help through the route you already trust
Report the flood through your normal support portal or known contact number. Someone knowing about the spam is not proof that they work for IT; they may have caused it.
Treat cleanup and remote access as separate decisions. Support can investigate the messages without giving an unverified caller permission to view or control a device. The remote-support article explains those permissions, while the Teams external-contact article covers requests arriving through another organization’s tenant.