Spam surge may signal exposed email addresses, ESET warns

Ahmet Taş | Acil Host

ISTANBUL, TURKEY — A sudden increase in spam or scam emails may indicate that an email address has been exposed or circulated among cybercriminals, cybersecurity company ESET has warned, urging users not to click or respond to suspicious messages.

ESET said unwanted email can rise for several reasons, including data exposure by companies, information circulating in underground cybercrime markets and the growing use of artificial intelligence to produce more convincing phishing campaigns.

A spam surge may point to an exposed email address

Email remains an essential communication tool for individuals and businesses, but inboxes can sometimes become flooded with unsolicited or malicious messages without any obvious reason.

According to ESET, a sharp increase in spam may mean that an email address has become part of a larger dataset circulating among cybercriminals.

Such exposure may occur after a company accidentally makes information publicly accessible or following a data breach in which customer information is obtained by malicious actors.

Once email addresses become available, they can be reused in phishing campaigns, fraudulent offers, credential-stealing attempts and other forms of online abuse.

The fact that an address receives more spam does not necessarily mean an account itself has been compromised. However, ESET’s guidance suggests that the change should be treated as a reason to become more cautious about unsolicited messages and login alerts.

Artificial intelligence can make scams more convincing

The growing availability of artificial intelligence tools is also changing the way phishing and spam campaigns are produced.

ESET said AI can help scammers create highly convincing messages designed to bypass spam filters and make fraudulent emails appear more legitimate.

Language mistakes and obviously suspicious formatting were once common warning signs in phishing emails. Generative AI can now help attackers produce more polished messages, making it harder for recipients to distinguish fraudulent communication from legitimate correspondence.

AI tools may also assist attackers during the information-gathering stage.

According to ESET, publicly available information can be processed to identify email addresses or other details that might otherwise be more difficult to discover manually.

That means users should not rely solely on spelling errors or poorly written messages when deciding whether an email is legitimate.

Do not click or reply to unsolicited messages

ESET’s first recommendation is straightforward: users should avoid clicking links or responding to unsolicited emails.

If a message claims to come from a bank, retailer, technology company or another organisation and requires action, users should independently find the organisation’s official contact details rather than relying on links, phone numbers or addresses provided in the suspicious message.

The sender’s domain name should also be checked carefully.

Attackers may register domains that closely resemble legitimate company addresses, using small spelling differences or visually similar characters.

ESET also advises users not to approve unexpected device codes or multi-factor authentication requests.

An unsolicited MFA notification can indicate that an attacker already has a password and is attempting to gain final access to an account by persuading the legitimate user to approve the login.

Users should therefore reject authentication requests they did not initiate and investigate unexpected login activity.

Limit how widely your main email address is exposed

Reducing unnecessary exposure of an email address can also help limit unwanted communication.

ESET recommends deselecting optional marketing permissions when shopping online rather than automatically agreeing to promotional messages.

Users may also want to keep social media accounts private where appropriate, particularly if contact information is publicly visible and can be collected automatically by web-scraping tools.

For new online services, email masking features such as “hide my email” can create alternative addresses instead of exposing a user’s primary account to every website.

This approach can also make it easier to identify the origin of unwanted messages if a unique masked address begins receiving spam.

ESET additionally points to services such as Have I Been Pwned and some identity-protection tools that can help users check whether their information has previously appeared in known data breaches.

Some services can also monitor for personal information appearing in compromised datasets or on dark-web marketplaces.

Such monitoring may provide an early indication that an increase in spam is linked to a wider data exposure incident.

Security software can add another layer of protection

Email providers already use automated filters to block large volumes of unwanted mail, but sophisticated phishing campaigns may still reach users.

ESET recommends security software that includes phishing and spam protection as an additional layer of defence.

According to the company, multi-layered security tools can help identify malicious communication, including campaigns that use more advanced phishing methods, AI-generated content or ready-made scam kits.

Technology alone, however, does not remove the need for user caution.

Messages that create urgency, request passwords or financial information, include unexpected attachments or attempt to move a user quickly toward a login page should be treated carefully.

Users should verify requests independently before sharing personal information or entering account credentials.

Keeping operating systems, browsers, email applications and security software updated can also help reduce exposure to known vulnerabilities.

Avoid unsubscribe links in obvious spam messages

One of ESET’s more notable recommendations concerns the familiar “unsubscribe” option.

While unsubscribe links can be legitimate in newsletters from trusted companies, ESET advises against clicking them in clearly unsolicited or suspicious spam.

In a malicious email, interacting with an unsubscribe link may confirm to the sender that the email address is active.

Similarly, replying to spam can provide confirmation that a real person is monitoring the account.

ESET recommends that users instead rely on their email provider’s spam or junk-reporting functions when dealing with suspicious messages.

Attachments in phishing emails should also remain unopened, as they may contain or deliver malicious software.

Users should never provide personal, financial or login information in response to an unsolicited email, even when the message appears professionally designed or claims to come from a recognised organisation.

Main email accounts should be protected more carefully

ESET also recommends limiting the use of a primary email address for low-value registrations such as free giveaways or public Wi-Fi services.

Using the same address across numerous services increases the number of organisations holding that information and can increase exposure if one of them suffers a breach.

The company also advises users to consider whether online stores need to retain personal details after a purchase.

Stored information may include email and home addresses as well as payment details, depending on the service.

If a retailer or platform is later compromised, retained customer information could become part of the exposed dataset.

Finally, users experiencing a sudden rise in unwanted messages should not respond by weakening their security settings.

ESET specifically advises against lowering spam-filter sensitivity or resetting email security protections simply because legitimate and unwanted messages have become harder to manage.

Instead, users should strengthen account protection, review suspicious login activity, enable multi-factor authentication where available and remain cautious about unexpected messages.

A surge in spam may ultimately be little more than an inconvenience, but ESET’s guidance suggests it can also serve as an early warning that an email address has become more visible to scammers or has appeared in previously exposed data.

AcilHost.Net