I have personally discovered compromised websites where threat actors can use code injection techniques to rewrite the recipient fields of contact forms. Basica

I have personally discovered compromised websites where threat actors can use code injection techniques to rewrite the recipient fields of contact forms. Basically, they inject their own email content into the contact form and then spam the email to known contacts of the compromised business. The result is that we receive mail that appear to come from sales@legitcompany<dot>com because they legitimately do come from there. But the content of the email is malicious. I've reached out to the IT departments of these vendors on a dozen occasions for this and similar activity but I've only EVER heard back from one who confirmed they were dealing with a breach. This is why I believe that for a medium size business to be secure, they need to have a dedicated IT person on staff. Small teams can get away with MSPs but they really do no favors for medium-large organizations when used in place of on premises IT. Oftentimes they even outsource overseas without warning, reducing overall security. Imagine paying an MSP to manage your network and then find out they basically just subcontract that out to some Indian firm from Fiverr. I've had that happen before too.