Registration Form Used To Send Spam Via Welcome Email

While reviewing a client site, I recently noticed a small number of accounts had registered with spurious firstName and lastName values such as:

After some digging, it appeared these customers had legitimate email addresses, however had placed no orders, nor had they interacted with our site.
Looking at the logs, these emails had received ‘welcome’ emails – which looked a bit like:

Which reveals the scam.
A bad actor had obtained a list of legitimate email addresses, and they were using the site to send spam, by signing up accounts using a bot.
The accounts then receive a ‘welcome email’ containing the spam links.
We quickly implemented invisible recaptcha on our signup form, and the problem disappeared.
Affected accounts were archived.
480 Words
32 Views