Legitimate web service abuse is an attacker technique that uses trusted online platforms, such as messaging apps, cloud storage, email, paste sites, or social media APIs, as relays for malicious activity. Instead of connecting directly to an attacker-owned server, malware sends requests to a service that is normally allowed in enterprise networks.
This matters because the traffic often looks like ordinary HTTPS to a popular domain, which can reduce the chance of simple firewall or reputation-based blocking. Attackers use it for command and control, data staging, token exchange, or to fetch instructions. Defenders look for mismatches between the service and the endpoint’s role, unusual API patterns, repeated polling, odd user-agent strings, or activity from hosts that should not use that service. Monitoring endpoint telemetry, proxy logs, and identity signals helps distinguish normal business use from abuse of a trusted platform.