Graymail Isn't the Threat. It's Where the Threat Hides.
Graymail can hide more than inbox clutter. Email bombing uses legitimate messages to distract employees and conceal social-engineering attacks.
Karen Letain CCO · · 6 min read
In January 2025, Sophos researchers documented an attack that started with a flood. One employee's inbox received about 3,000 emails in 45 minutes. Newsletters. Sign-up confirmations. Welcome messages from services they had never heard of.
None of them were malicious. That was the point.
Shortly after, the employee got a Microsoft Teams call from an external account named "Help Desk Manager," offering to help with the spam.
The flood wasn't the attack. It was the setup.
I keep coming back to that story because graymail keeps coming up in customer conversations. One customer asked us if we could please filter graymail the same as their incumbent vendor does, which made us pause and wonder if a graymail feature the way it's done today by most email security vendors is the right approach. And it raises a question our industry rarely asks out loud. Microsoft and Google already filter graymail.
So why does almost every email security vendor, including us, get asked to do it too?
My answer: graymail isn't the threat. It's where the threat hides.
What graymail actually is?
Graymail is email you asked for at some point and no longer want. The webinar you registered for two years ago. The newsletter from a trade show booth scan. The SaaS tool that notifies you every time someone comments on a file.
It isn't spam.
You opted in, the sender is real, and the message is legitimate.
Think of it as the inbox's junk drawer. Everything in it was useful once. Nothing in it is dangerous. And nobody can find anything in there when it matters.
That legitimacy is what makes graymail hard. Spam filters are built to catch bad senders. Graymail comes from good ones.
The insight: graymail is a relevance problem, not a reputation problem.
Why it's more than a nuisance
It taxes attention. Every irrelevant message spends a little of the reader's focus. People who wade through a hundred emails a day skim. Skimming is what phishing counts on.
It's camouflage. The most effective phishing doesn't look like phishing. It looks like a signature request, an invoice update, a password expiry notice. It looks like graymail.
It can be weaponized. Email bombing is a denial-of-service tactic for the inbox, and it's built entirely from graymail. Attackers sign a target's address up to hundreds of legitimate newsletters and subscription forms. Every message is real. Every sender is clean.
This isn't theoretical. In May 2024, Microsoft Threat Intelligence described Storm-1811, a group known to deploy Black Basta ransomware, doing exactly this. Flood the inbox. Then call as IT support, offer to fix the spam, and talk the user into opening a remote access session. By late May the group had moved the call to Microsoft Teams, using accounts named "Help Desk" and "IT Support." CISA later added the tactic to its Black Basta advisory.
Think of the bomb as a smoke grenade before a heist. The smoke isn't the robbery. It buries the alarm and makes the stranger offering help look like a rescuer.
The case for Microsoft and Google
Let me argue the other side first, because it's strong.
Microsoft and Google see more email than anyone on earth. They own sender reputation at a scale no third party can match. They know whether millions of people open, ignore, or report a given newsletter. In graymail, that data is the whole game.
They've also been busy. Gmail sorts mail into Promotions and Updates. Microsoft scores bulk mail and runs Focused Inbox. Since 2024, Gmail has required bulk senders to offer one-click unsubscribe. And in mid 2025, Microsoft added Mail Bombing Detection to Defender for Office 365. It's on by default and routes bombing campaigns to the Junk folder.
Now add a second vendor that also sorts graymail. Two verdicts on the same message. Two quarantines. Users who don't know where to find the email they actually wanted. It's two bouncers at the same door, checking the same IDs, while nobody watches the back entrance.
Think of the platform as the post office. It already knows which senders mail a million flyers a week. You don't hire a private courier to re-sort what the post office already sorted.
The insight: for graymail as clutter, the platform is better equipped. Any vendor who claims otherwise won't survive a technical buyer.
The case for the security layer: the haystack problem
Now the part that cuts the other way.
Filtering graymail doesn't shrink the haystack. It moves it. When 3,000 newsletters land in Junk, the inbox looks clean. For the user, that's a win. For a defender, every one of those messages is still hay the needle could be hiding in.
And in an email bomb, there is no bad message to find. Every sender is legitimate. Every confirmation is real. A filter that judges one message at a time sees nothing wrong, because nothing is wrong with any single message. The attack lives in the pattern, and in what the pattern is hiding: the real password reset or bank alert buried underneath.
Then there's the part sorting can't touch. The needle often isn't in email at all. In the Storm-1811 campaign, Microsoft's own researchers describe the flood as the setup. The real attack came next, in a phone call or Teams chat from someone posing as IT support and asking for remote access. The flood is the distraction.
Back to the post office. It can bale the hay. It can't tell you someone dumped that hay in your barn on purpose, or that the person at your door offering to haul it away is the one who dumped it.
The insight: sorting graymail solves the symptom the attacker doesn't care about.
So who should solve it?
Both. Doing different jobs.
The platform owns volume. Sender reputation, tabs, bulk scoring, rate-based bombing detection. That's infrastructure, and Microsoft and Google should keep doing it.
The security layer owns meaning. What is this message asking the reader to do? What might this flood be covering up? What usually comes next, and on which channel?
That's also how I think about the graymail requests we get. Customers are right to ask. The pain is real, and once the market set the expectation, it became a checkbox. But a security vendor that just re-sorts graymail is building a neater haystack. One that understands graymail is looking for the needle. The post office sorts. The detective reads. Same mail, different questions.
The insight: graymail handling belongs in security only as a byproduct of understanding intent, and it should be reported separately from threats.
What this means for buyers
If you're evaluating email security, or renewing it, the graymail question is a good test of how a vendor thinks. Four questions for you to answer:
- Does your graymail handling duplicate or conflict with what Microsoft or Google already does? Where does a user go to find a misfiled message?
- When an inbox gets bombed, do you show me what was buried in the flood?
- Do you connect an inbox flood to what happens next in Teams or on the phone?
- Do you report graymail separately from threats, or does a newsletter count as a "message handled"?
And one for your own team. If an employee's inbox filled with 3,000 sign-up emails in an hour, would they recognize the friendly call from IT a few minutes later as the second half of the attack?
Clearing the smoke is useful. Knowing who threw it, and why, is security.
Final Thoughts: Don't Just Clear the Inbox. Find the Attack.
Graymail is not inherently malicious. A newsletter someone no longer reads or a notification from a legitimate service is usually just clutter. The problem changes when an attacker deliberately uses that clutter to overwhelm an inbox, divert attention, or make a fraudulent request harder to notice.
That is the distinction email security needs to get right.
Microsoft and Google are well positioned to handle bulk-mail classification, sender reputation, and inbox organization. A security layer has a different responsibility: recognizing when a pattern of activity may be deliberate, what the noise could be concealing, and whether the next step might arrive through another channel.
For buyers, that means asking more than whether a vendor can move unwanted messages out of the inbox. Ask whether it can help identify what was buried in the flood, connect the flood to suspicious follow-up activity, and distinguish legitimate bulk mail from an attack pattern.
A cleaner inbox is useful. But a clean inbox does not necessarily mean the threat has been addressed.
The platform sorts. The detective reads.
And when graymail becomes the cover for an attack, understanding why it is there matters more than simply deciding where it belongs.
FAQ
Is graymail the same as spam?
No. Spam is generally unsolicited or unwanted bulk messaging, while graymail often comes from a legitimate sender the recipient previously agreed to hear from. That distinction matters because a reputation-based filter may correctly identify the sender as legitimate even when the messages contribute to an inbox flood that an attacker can exploit.
What is email bombing?
Email bombing is a tactic in which an attacker causes a target to receive a large volume of messages, often by signing the target's address up for legitimate newsletters and subscription services. The flood can overwhelm the recipient and make important messages harder to find. It may also serve as a distraction for a follow-up social-engineering attempt.
How can graymail be used to hide a cyberattack?
An attacker can overwhelm an employee with legitimate messages, making it harder to notice an important security notification or suspicious request. In documented scenarios discussed in this article, the flood was followed by someone posing as IT support and offering to resolve the problem. The flood created the distraction; the social-engineering interaction was the next stage of the attack.
Can filtering graymail prevent email bombing attacks?
Graymail filtering can reduce inbox clutter, but sorting messages alone does not necessarily establish whether a flood was deliberately triggered or what it might be concealing. Effective defense also requires investigating suspicious activity patterns and considering whether the flood connects to a follow-up request through another channel.
Should Microsoft and Google handle graymail?
They are well positioned to handle large-scale bulk-mail classification, sender reputation, and inbox organization. Karen's argument is that a third-party security vendor should avoid merely duplicating those functions and should instead focus on the security context around the messages and the patterns they may form.
What should an email security platform do when an inbox is bombed?
It should help security teams understand more than the message volume. Relevant questions include what important communication may have been buried, whether the flood appears deliberate, and whether suspicious contact followed through Microsoft Teams or a phone call. These signals can help teams investigate the wider incident rather than treating every message as an isolated item.
How is graymail different from a phishing email?
A graymail message is generally legitimate but unwanted. A phishing email attempts to deceive the recipient into taking an action, such as disclosing information or approving a request. An email flood can contain legitimate messages while helping conceal a separate phishing or social-engineering attempt. The flood's overall context may therefore be security-relevant even when its individual messages are not malicious.
Why does context matter in email security?
A message may look harmless when evaluated by itself. Its significance can change when considered alongside the recipient's normal activity, the volume and timing of other messages, and what happens next. Context helps security teams distinguish ordinary inbox clutter from activity that may be part of a deliberate attack.
What should buyers ask when evaluating graymail handling?
Buyers should ask whether a vendor duplicates or conflicts with the platform's existing sorting, how employees can recover messages that are misclassified, whether the system helps identify important messages buried in an email flood, whether it connects the flood to subsequent activity across channels, and whether graymail is reported separately from genuine threats.