Loading story…
Researchers reported that threat actors are inserting fake invoices and purchase receipts into Shopify’s legitimate Shop order-tracking app, making fraudulent charges appear more credible than traditional phishing emails. The bogus orders impersonate brands including Norton, McAfee, Apple, and PayPal, often claiming high-value purchases, gift cards, iPhones, or subscription renewals. Each fake receipt directs victims to a scam-controlled support number, exploiting trust in the app’s normal order history and notifications.
Once victims call, the attackers use callback-phishing tactics to steal payment card details, passwords, and one-time passcodes, and in some cases persuade users to install remote-access software. Researchers said the exact insertion method remains unconfirmed, but it may involve merchant workflows, email parsing, or other order-ingestion paths in the Shop ecosystem; they found no evidence that Shop, Shopify, or the impersonated brands were breached. Public reports indicate the activity is ongoing, and users are being urged to verify charges only through official brand sites, bank or card-provider accounts, and to avoid phone numbers embedded in suspicious receipts.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Gen Digital researchers documented a scam in which fraudulent invoices and purchase receipts appear inside the legitimate Shop order-tracking app, impersonating brands such as Norton, McAfee, Apple, and PayPal. The researchers said the fake orders direct victims to scam-controlled phone numbers and found no evidence that Shop, Shopify, or the impersonated brands were breached.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
huntress.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign targeting **Apple Pay** users is using realistic-looking emails to push victims into calling a fraudulent “Apple Support” phone number, shifting the attack from link-clicking to **vishing** (voice phishing). The lure commonly claims a high-value Apple Store charge was attempted or stopped, and includes plausible details (e.g., **case ID**, timestamp, and an “appointment” to review the activity) to create urgency and legitimacy. Malwarebytes reported the operation’s objective is to extract **login/verification codes** and **payment data** during the phone interaction, enabling attackers to take over the victim’s Apple account and potentially access associated data and linked payment methods. Follow-on reporting highlighted the use of Apple branding and invoice-style formatting (including high-ticket purchase claims) to increase conversion, and emphasized the potential impact of account compromise beyond payment theft (e.g., access to stored personal data and connected services).
Jun 30, 2026
Cybercriminals are distributing bulk phishing emails that impersonate well-known brands such as PayPal and HP to execute tech support scams. In one campaign, recipients receive a fake PayPal invoice from a Gmail address, with the email BCC'd to many targets and containing a suspicious attachment. The invoice claims the recipient has been billed $823 and urges them to call a phone number to dispute the charge, a tactic designed to create urgency and lure victims into contacting the scammers directly. The email passes SPF, DKIM, and DMARC checks because it originates from a legitimate Gmail server, but the sender address and lack of branding are clear indicators of fraud. A similar scam involves emails purporting to be from HP, including a PDF attachment and instructing recipients to call a provided phone number. The phone number connects to a generic call center that does not mention HP and instead attempts to engage the victim in a warranty renewal scam. These callback phishing schemes often use phone numbers that appear in multiple scam reports online and are answered by operators trained to adapt their script based on the brand the victim mentions. Both scams exploit technical authentication checks and social engineering to bypass suspicion and trick users into divulging sensitive information or making payments.
Jul 12, 2026
Multiple campaigns are abusing *legitimate* cloud and platform workflows to make phishing and fraud harder to detect. Attackers are generating real Apple and PayPal invoice/dispute emails and embedding scam phone numbers in user-controlled fields (e.g., “seller notes”), resulting in messages that carry valid **DKIM** signatures and originate from high-reputation domains; this “**DKIM replay**” style abuse bypasses many email controls because authentication validates the sender domain, not the safety of the embedded content. In parallel, threat actors are leveraging free **Google Firebase** developer accounts to host brand-mimicking phishing pages on trusted `firebaseapp.com` / `web.app` subdomains, increasing delivery and click-through rates by exploiting domain reputation and common allowlisting of Google infrastructure. A separate but related social-engineering technique targets **Telegram** users by manipulating Telegram’s official authentication workflows to obtain fully authorized sessions rather than simply stealing passwords. Victims are lured to Telegram-lookalike pages (often on ephemeral domains) that prompt QR scanning or phone-number entry; user interaction triggers a real login attempt initiated by the attacker, and once the victim approves the authorization prompt on their device, the attacker gains persistent account access and can pivot to follow-on attacks via the victim’s contacts. These incidents collectively highlight a shift toward “living off trusted services,” where adversaries avoid compromising vendors and instead weaponize legitimate features, trusted domains, and sanctioned authentication flows to reduce detection and increase victim compliance.
Jun 29, 2026