Cheetahmail is not related to Epsilon, the ESP whose security failures have been in the news lately, but as this spam shows, their security is unfortunately no better.

At this point, in view of the large number of ESPs that have fallen victim to what appears to be the same attack, the safest thing for people to do is to assume that all mail from commercial senders is hostile, do not click on any of its URLs or visit any web site it mentions.

Update: A few people have pointed out that it looks like the spammers phished credentials from one of Cheetahmail's clients and are using them to spam. That may well be true. So what? The spam is coming from Cheetahmail, it's their job to keep it from happening.

The spam has a funky URL that points to a web server in China, a bit implausible for a clothing retailer that operates only in North America. This reinforces my point that ESPs have a lot of valuable data, and they need to treat it that way, which includes looking for activity that is likely to be customer fraud. It's the same reason that my bank calls me on the phone to check when I do something out of the ordinary.