Trusted Retail Emails Hide Phone Scams

Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move victims into a phone-based scam. Talos also observed similar abuse of registration notifications and mail delivery failure reports to carry phishing lures through legitimate infrastructure.

Key findings

• Talos observed roughly 1,400 malicious messages abusing Staples and Dell transactional email workflows.
• The attackers used legitimate, authenticated brand email infrastructure, so the messages passed DKIM and DMARC checks despite malicious content in the rendered order details.
• Both retail campaigns used an unexpected high-value purchase and an embedded phone number to pressure recipients into calling an attacker-controlled helpline.
• Talos observed list-bombing and registration-form abuse where attacker-provided text was reflected into legitimate automated emails.
• A delivery-status notification carried a WeTransfer-themed file-sharing lure, demonstrating that even a legitimate bounce message can include untrusted nested content.
• Sender authentication confirms expected sending infrastructure, but does not prove that the transaction details, phone number, or other rendered content are legitimate.

Who’s being targeted

• Commonly targeted roles: All employees, Finance and accounts payable, Procurement, Executive assistants, Customer support, IT help desk, Email security teams.
• Affected industries: Retail, Technology and computer sales, Software-as-a-Service platforms, Email and collaboration services, Financial services and payment teams.
• Attack channels: email, vishing.
• Impersonated: Staples order support, Dell sales team or order support, Mail delivery system notification.

Awareness takeaways

• Do not call phone numbers included in unexpected order emails. Find the retailer’s support number independently through its official website, app, or a known account page.
• Treat unexpected purchase confirmations as suspicious even when the sender passes normal email authentication checks.
• Do not trust links, attachments, or requests inside a delivery-failure notice simply because the outer message looks like a system notification.
• Report emails whose order, shipping, billing, profile, or support fields contain unexpected phone numbers, URLs, urgency language, or instructions.

Red flags to watch for

• An unexpected high-value Apple iPad purchase.
• A support phone number appears inside shipping or billing-style order details.
• The email urges a phone call rather than directing the recipient to a known Staples account or support channel.
• An unexpected software purchase totaling $736.09.
• “Helpline” and “Call Our Sales Team” text appears in address fields rather than normal support locations.
• The sender and template may look legitimate, but the phone number is not independently verified.
• A delivery-failure message contains a file-sharing request unrelated to a message the recipient sent.
• The administrative wrapper is used to make embedded content appear routine.
• A bounce message asks the user to interact with a link, attachment, or file-transfer workflow rather than simply explaining a delivery failure.