“I am contacting you today because we located a botnet being hosted on your forehead, please take immediate action thanks.”
Anyone could sign up for the FBI’s law enforcement portal. The site then put the one-time passcode in its own page source and let the browser set the subject and body of mail sent from fbi.gov. Tens of thousands of fake warnings went out from a real FBI server. The bureau that lectures companies about cyber hygiene wrote a spam cannon and left it open.