Cisco Talos found roughly 1,400 scam emails sent through legitimate Staples and Dell order-notification systems. Attackers placed fake helpline numbers and support prompts into order fields, causing trusted retailers to email recipients about purchases they did not make. The scam then pressures recipients to call an attacker-controlled number rather than verify the order through official channels.
Cisco Talos identified roughly 1,400 scam emails that were delivered through the legitimate transactional-email systems of Staples and Dell. Rather than spoofing a sender or registering a lookalike domain, attackers inserted fraudulent support prompts and phone numbers into order fields such as shipping, billing, name, company, or title. When the retailer's systems generated a real order-confirmation email, those fields were reflected back to the recipient, turning a routine transaction notice into a vehicle for a phone-based scam.
One version used a fake Apple iPad purchase through Staples, with a helpline number planted in the shipping or billing fields alongside the phrase "Order Confirmed." A second version used a fabricated Microsoft Project Standard 2024 order totaling $736.09 through Dell, with "Confirmed Order," a helpline number, and "Call Our Sales Team" placed in the Ship To and Bill To sections. In both cases, the message pushed recipients toward calling an attacker-controlled number about a purchase they never made.
The emails passed DKIM and DMARC checks because they genuinely originated from Staples and Dell infrastructure. This let the scam bypass a common defensive assumption: that authenticated, properly aligned email is inherently safe. Authentication confirmed where the message came from, not whether every instruction inside it, like a phone number, could be trusted. Because the campaign relied on trusted commerce workflows instead of forged identities, it was harder to catch with sender-based filtering alone.
Organizations and individuals should treat unexpected purchase notices as a prompt to verify, not to call the embedded number. Checking an order through an independently accessed retailer account, official app, or known support channel removes the attacker's leverage entirely. Security teams should also encourage reporting of suspicious transactional messages even when sender authentication looks clean, since this campaign shows that legitimate delivery infrastructure can still carry manipulated content aimed at procurement, finance, and other staff who regularly handle order confirmations.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Cisco Talos found that attackers inserted fraudulent support prompts and telephone numbers into fields like shipping, billing, name, company, or title, which legitimate retailer systems then reflected back in authentic order-notification emails.
The messages passed DKIM and DMARC checks because they originated from legitimate Staples and Dell infrastructure, showing that authenticated delivery does not prove the content of a message is safe.
Do not call the number inside the email. Instead, verify the purchase through an independently accessed retailer account, official app, or a known support channel.
One set of messages referenced a fake Apple iPad purchase through Staples, and another referenced a Microsoft Project Standard 2024 order totaling $736.09 through Dell, each with a fraudulent helpline number embedded in order fields.
A real Staples order email says you bought an iPad. You didn’t. Here’s the trick: someone puts ‘Helpline 806 283 7712’ in the shipping details. Staples sends the email, and that number rides along. Dell emails did it too: a $736.09 Microsoft Project order put ‘Call Our Sales Team’ in Ship To and Bill To. Even DKIM and DMARC passed. That’s the giveaway: real sender, planted phone number. Don’t call it, open your retailer account yourself to check the order.
Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…
Attackers abused legitimate platforms to send phishing emails that appeared to be genuine Dell order confirmations and passed standard email-authentication checks. The messages used a fake $736.09 purchase and placed a “Helpline” phone number in the shipping-address field, trying to persuade…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
Attackers are posing as internal IT support staff in Microsoft Teams, often after flooding an employee’s inbox with subscription emails to create urgency. They persuade victims to grant remote access through legitimate support tools, then install malware, steal information, and in some cases deploy…
Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses…
