If your email account has been flagged for suspicious activity or your SMTP credentials, it's often the result of compromised credentials. Below are the most common ways attackers gain access to email accounts and what each method means for you.
Organizational and setup-related vulnerabilities:
| Cause | How it happens |
|---|---|
| Website / CMS plugin compromise |
A vulnerable website plugin or contact form (e.g. SMTP/mail plugins)
that stores SMTP credentials in configuration files or databases
can be exploited. Attackers retrieve these credentials and use
the
organization's SMTP server to send spam or phishing emails.
Related articles |
| Shared credentials | SMTP credentials are intentionally shared among employees, contractors, or third-party service providers. The more people or systems that know the password, the greater the chance of accidental exposure or misuse. |
| Insider misuse | An employee, administrator, or contractor with legitimate access intentionally uses SMTP credentials for unauthorized purposes. This can include sending spam, exfiltrating data, or sharing credentials with external parties. |
| Man-in-the-middle (MitM) | If users connect over insecure networks (e.g. public Wi-Fi) through malware that intercepts traffic, attackers may capture authentication data or session information. Modern TLS significantly reduces this risk, but it can still occur if certificate warnings are ignored or endpoints are compromised. |
| Application or server configuration exposure | SMTP credentials are accidentally exposed in application configuration files, source code repositories, backup files, log files, or CI/CD pipelines. Attackers regularly scan public repositories and exposed servers for hardcoded secrets and immediately abuse any credentials they find. |
Your credentials were exposed:
| Cause | How it happens |
|---|---|
| Phishing | Attackers trick users into entering their email credentials on a fake login page that closely resembles the legitimate webmail or email provider's login page. Once the user submits the credentials, the attacker immediately uses them to authenticate to SMTP, IMAP, or webmail services. |
| Password reuse | Users reuse the same password across multiple online services. When another website suffers a data breach, attackers obtain those credentials and test them against email services using automated tools. |
| Credential stuffing | Attackers use large collections of leaked username/password pairs from previous breaches and automatically test them against SMTP, IMAP, and webmail login endpoints. Any reused credentials that remain valid are immediately compromised. |
| Weak password | Users choose passwords that are short, predictable, or based on common words and patterns. Attackers can successfully guess these passwords using dictionary attacks, password spraying, or brute-force attempts. |
Your device or software was compromised:
| Cause | How it happens |
|---|---|
| Malware / infostealer | Malware running on the user's computer steals saved passwords from browsers, email clients, or operating system credential stores. The stolen credentials are uploaded to attacker-controlled servers and later used to send spam or gain unauthorized mailbox access. |
| Email client compromise | Email clients such as Outlook, Thunderbird, or Apple Mail often store SMTP/IMAP credentials locally for convenience. If the user's computer is compromised, attackers can extract these stored credentials without requiring the user to re-enter the password. |
| Webmail session or browser compromise | Browser malware, malicious extensions, or stolen session cookies allow attackers to access the user's webmail account. They may also recover stored credentials or reset application passwords, enabling SMTP access without knowing the original password. |
A strong, unique password is your first line of defence — avoid reusing passwords across services and update them regularly. Here are some best practices to follow to create and manage a strong password.
Turn on two-factor authentication on your email account to ensure that a stolen password alone is not enough to let attackers in. Read on to learn more about using 2FA for your Neo account.
Most SMTP compromises are preventable. Understanding how SMTP credentials get compromised is the first step to protecting them. Whether the risk comes from your password, your device, or your setup, the right controls and habits can stop most attacks before they start.
Feel free to knock on our door by writing to us at hello@neo.space in case you need any assistance with configuring these records.