Hackers turned the agency's own mail infrastructure into a spamming machine, sending bogus warnings to more than 100,000 addresses. The messages looked like they came from inside the FBI, and for many recipients the technical proof checked out. According to reporting by Bleeping Computer, the operation was first flagged by the Spamhaus Project, a non-profit that tracks email spammers.
The spoofed emails claimed a cybersecurity researcher was behind a "sophisticated chain attack" and falsely tied him to a notorious hacking crew. They were crafted not to steal from victims in the inbox, but to smear a real person. The sender allegedly used a flaw in an FBI web portal to make the whole thing work.
At a glance
- Hackers sent spoofed emails from real FBI servers to over 100,000 addresses.
- The messages were first spotted by the Spamhaus Project, a spam-tracking non-profit.
- Emails falsely accused a security researcher, Vinny Troy, of orchestrating a major attack.
- Recipients were scraped from ARIN, the U.S. Registry for internet number resources.
- Headers passed DKIM checks, a core authentication method used by Gmail and others.
- The FBI said the affected hardware was taken offline and called it an ongoing situation.
- A user called "Pompompurin" claimed responsibility and pointed to a flaw in the FBI's LEEP portal.
What actually happened
The campaign abused the FBI's Law Enforcement Enterprise Portal, a site used by law enforcement and partners. According to Bleeping Computer and KrebsOnSecurity, the attacker registered an account by exploiting a one-time code that was exposed in the page's HTML. From there, they could spoof the sender address and the body of the message.
Because the mail originated on FBI infrastructure, it cleared DKIM, the cryptographic signature that email systems use to confirm a message is genuine. That is the same check Gmail performs before it stamps a corporate logo on a verified sender. To a casual eye, the warning looked indistinguishable from a real bureau alert.
Troy runs two security firms that monitor dark web markets. The attacker linked him to The Dark Overlord, the group that leaked episodes of Orange Is the New Black. The intent, researchers say, was reputational damage, not data theft.
Background: why spoofing from a .gov address hurts more
Government domains carry trust by default. Filters tend to be less aggressive toward mail from .gov, and many recipients skip extra caution when they see familiar agency branding. A 2021 executive order from President Biden pushed civilian federal systems to harden their cyber defenses after the Colonial Pipeline and SolarWinds intrusions. A few days before this incident, Biden also directed agencies to patch known threats. The bar was supposed to be rising.
It is not just embarrassing. When a government domain becomes a spam source, it trains users and filters to distrust legitimate alerts. The next real warning may get flagged or ignored.
Our analysis
This is less about one bad form and more about a pattern. Attackers increasingly target identity and authentication gaps in web portals, not just mail servers. A one-time code sitting in client-side HTML is a textbook example of broken access control, a flaw category that has topped vulnerability lists for years.
Who benefits? The attacker gets a megaphone and a reputation hit on a named researcher. Who loses? Every IT team that now has to treat FBI mail with suspicion, plus Troy himself. The FBI loses trust capital it cannot easily rebuild.
The most uncomfortable part: the attacker publicly bragged about doing more, including tricking companies into transferring data. That is a threat, not a confession of past damage. Watch for follow-on phishing tied to this tactic.
Say you are on the receiving end
Imagine you are an IT manager at a mid-sized company. Monday morning, your inbox has 30 "FBI incident" warnings, each claiming your network was hit by a chain attack. The from address is eims.cjis, a real FBI subdomain. DKIM passes. What do you do?
Do not reply to the address or call any number in the message. Open a fresh browser window and navigate to fbi.gov yourself, or call a number from prior agency contact. Treat any attachment as hostile. Report the message to your abuse desk and to the FBI's Internet Crime Complaint Center through a channel you found on your own. Save full headers for the investigation. The technical fact that DKIM passed does not mean the content is true, only that the sending server was genuine.
What to watch next
Expect more spoofing from trusted government and enterprise web portals until agencies audit where their one-time codes live. Until then, treat any urgent "you've been hacked" message, even from a familiar agency, as a possible phishing lure. Verify through a channel you control, not the one the message provides.
Frequently asked questions
How did hackers send email from FBI servers?
They abused the FBI's Law Enforcement Enterprise Portal by exploiting a one-time code that was embedded in the page's HTML, which let them register an account and spoof the sender address.
Did the spoofed emails really come from FBI servers?
The headers passed DKIM checks, meaning the messages were sent from infrastructure tied to the FBI's Criminal Justice Information Services division. That does not mean the FBI wrote or approved the content.
Who was the attacker trying to smear?
Security researcher Vinny Troy, who runs dark-web monitoring firms NightLion and Shadowbyte. The emails claimed he was behind a major attack and falsely linked him to the group The Dark Overlord.
How many people received the fake warnings?
More than 100,000 addresses received the messages, according to Bleeping Computer. The addresses were scraped from ARIN's public database.
What did the FBI say about the incident?
The FBI said the affected hardware was taken offline and called it an ongoing situation. It did not share further details.