Cybercriminals Leverage Atlassian Cloud for Spam Campaigns Redirecting Targets to Fraudulent Investment Schemes

Cybercriminals have launched a sophisticated spam campaign leveraging the trusted infrastructure of Atlassian Cloud.

By abusing legitimate features within the platform, attackers are effectively bypassing traditional email security controls to reach high-value targets.

This campaign focuses on redirecting users to fraudulent investment schemes, utilizing the inherent trust associated with well-known software-as-a-service providers to deceive recipients.

The attacks are highly targeted, focusing on government and corporate entities across various regions, including English, French, German, Italian, Portuguese, and Russian-speaking demographics.

Instead of generic spam, these messages are tailored to specific language groups. The ultimate goal is to funnel traffic to malicious landing pages via Keitaro TDS, generating revenue through scams and illicit advertising.

Trend Micro researchers identified that this activity became prominent between late December 2025 and January 2026.

By operating through established cloud services with strong domain reputations, the attackers ensure their emails pass standard authentication checks like Sender Policy Framework and DomainKeys Identified Mail.

This makes detection significantly harder for conventional security filters, which typically prioritize notifications from reputable SaaS platforms.

The campaign demonstrates a high level of automation, allowing threat actors to rapidly scale their operations.

They create multiple Atlassian instances to distribute their messages, ensuring that even if one instance is blocked, others continue to function.

This resilience highlights the evolving tactics of modern cybercriminals who weaponize legitimate tools to conduct malicious activities without triggering immediate alarms.

Mechanism of Infrastructure Abuse

The core of this campaign lies in the ease with which threat actors can provision disposable infrastructure to facilitate their attacks.

Attackers initiate the process by creating Atlassian Cloud accounts using randomized naming conventions, enabling them to generate numerous Jira Cloud instances without requiring domain ownership verification.

These instances resolve to legitimate AWS IP addresses shared by valid deployments, further masking the malicious nature of the activity. Attackers rely on the inherent trust of Atlassian-generated emails rather than reinforcing legitimacy through domain registration.

Once the infrastructure is in place, the attackers utilize Jira Automation to construct and send crafted emails.

This method allows them to deliver messages directly through Atlassian’s integrated email system, avoiding the need for their own mail servers.

The recipients do not need to be listed users within the instance, permitting widespread distribution without exposing the attacker’s true identity or infrastructure.

Organizations should reassess their trust assumptions regarding third-party cloud-generated emails to prevent such abuses. Security teams are advised to deploy advanced email security solutions that provide layered detection and identity-aware controls.

These measures are essential to identify and block phishing attempts that exploit trusted SaaS platforms. Additionally, monitoring for indicators of compromise, such as specific URL patterns and redirect chains, can help mitigate these threats effectively.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.