Attackers abused legitimate platforms to send phishing emails that appeared to be genuine Dell order confirmations and passed standard email-authentication checks. The messages used a fake $736.09 purchase and placed a “Helpline” phone number in the shipping-address field, trying to persuade recipients to call the attacker.
This scheme relied on a fake Dell order confirmation claiming the recipient had purchased Microsoft Project Standard 2024 for $736.09. The email was sent through legitimate platforms that allowed it to use Dell's real order domain and template, letting it pass standard DKIM and DMARC authentication checks. Rather than including a malicious link, the email listed the word Helpline and a phone number in the Ship To field, a spot normally reserved for a delivery address. This pushed recipients toward a callback scam, where the real social engineering happens over the phone once the victim calls in.
The combination of an authenticated sending domain and Dell's genuine template made the message look far more convincing than a typical spoofed email. Most employees are trained to scrutinize sender addresses and authentication status, but this lure passed those checks cleanly. The unusual placement of a phone number where an address should appear is easy to overlook, especially when the rest of the email appears routine and the recipient is reacting to an unexpected charge rather than examining formatting closely.
Organizations should remind all employees, procurement teams, finance staff, and customer service personnel that authentication checks passing does not guarantee a message is legitimate. Staff should be encouraged to independently verify any unexpected order by contacting the vendor through officially published channels rather than numbers listed in the email itself. Training should also highlight that unusual fields, like a phone number in place of a shipping address, are a strong indicator of a callback scam. Because this technique mirrors legitimate business communication so closely, awareness programs should emphasize verifying purchase details against actual procurement records before any action is taken, whether that's calling a number or replying to the message.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers sent the phishing message through legitimate platforms using Dell's real order domain and template, which allowed it to pass standard DKIM and DMARC authentication checks.
Instead of a shipping address, the email displayed the word Helpline along with a phone number in the Ship To field, directing recipients to call attackers rather than click a malicious link.
Treat unexpected purchase confirmations as suspicious even if the sender domain looks legitimate, avoid calling any phone number listed in the email, and verify the purchase through the vendor's official contact channels instead.
A Dell order confirmation lands in your inbox. Looks real, right? It uses Dell’s real template and order domain, and passes DKIM and DMARC. But it says you bought Microsoft Project Standard 2024 for $736.09. Here’s the giveaway: 'Ship To' has no address. It says 'Helpline' with a phone number. Calling it puts you into their callback scam. Don’t call that number. Open Dell’s website yourself and use its listed support contact.
Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Microsoft says attackers have been compromising Microsoft 365 cloud accounts by posing as internal IT staff and pressuring employees to “update” passkeys or sign-in settings. Victims are directed to lookalike sign-in pages or tricked into authorizing attacker access via device-code sign-in, after…
Researchers linked the Iran-aligned Handala Hack persona to a Telegram-controlled backdoor (HEAVYGRAM) that can steal passwords and exfiltrate chat data. The campaign reportedly starts with social engineering on messaging apps (Telegram, WhatsApp, Instagram), where the attacker pretends to offer…
