Email propagation is malware spread that uses mail systems to copy itself to other users. Instead of waiting for a victim to download a file from the web, the malware sends messages through the infected user’s account, often by reading contacts, address books, or recent conversations. This matters because mail traffic is trusted and high-volume, so a single compromised host can rapidly turn into many more infected inboxes.
In real attacks, email propagation often combines attachment deception, script execution, or stolen mail credentials with automated sending. Defenders look for unusual outbound mail bursts, messages with the same attachment or link, and suspicious use of contact lists. Mail filtering, attachment controls, script restrictions, multi-factor authentication, and rate limits on sending all help slow or stop this spread pattern.