Security incident: phishing-like Email created by “System” (not sent by user)

[lj4353]

Hello everyone,

We would like to report and ask about a security incident observed in our EspoCRM instance, and check whether anyone else has experienced the same issue.

An Email record was created with Created By: System, with the following characteristics:

• The sender and recipient are the same internal user email address
• The email content looks like a security alert, stating:
  “abnormal activity was detected, please verify identity and change password”
• This email was NOT sent by the user
• No user manually created or sent this email
• The record shows Created / Modified by: System
• The email was generated inside EspoCRM, not by the mail provider

We want to clearly state that this was not a legitimate email sent by the user, and the message resembles a phishing-style notification, even though it originated internally.

At this stage, we are treating this as a security incident and are trying to understand:

• Whether this behavior is known or previously reported
• Whether it can be triggered by Workflow, Scheduled Jobs, API, or custom code
• Whether other EspoCRM users have encountered similar System-created emails

Has anyone experienced the same or a similar issue?

Any shared experience or insight would be greatly appreciated.

Thank you.

[yuri]

Imported from an IMAP server emails are created by the System user. It's likely was imported from the mail server. If it's not available on the webserver, maybe it was deleted or moved to some folder.

[lj4353]

Thank you for the explanation.

However, I can see this email in the EspoCRM “Sent” folder.
Emails imported from an IMAP server should normally not appear in the Sent folder, as IMAP is used for incoming emails.

I have already also disabled:

Lead Capture / Web-to-Lead API entry point
API Users

Even after disabling these components, phishing-like emails created by System are still appearing in the Sent folder.

This is concerning because the emails were not sent by any user, were created by System, and resemble fake security notifications.
So far, this has only occurred for users with personal email permissions.

This is very alarming to me. I am concerned that customer or lead data may have been exposed, and I am also worried that the same mechanism could be abused to send similar emails to customers.