Attackers hide scam helplines in Staples and Dell order emails
Original title: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks passed while pushing victims to call.
Cisco Talos says attackers are placing scam content inside legitimate order-notification workflows rather than forging senders. In Staples and Dell campaigns totaling roughly 1,400 messages, shipping or billing fields carried attacker phone numbers beside high-value purchases. DKIM and DMARC passed for the retailers' domains, so authentication did not show that the transaction or helpline was legitimate. Talos says unexpected phone numbers, URLs and support text in transactional fields should be rejected or flagged.
Unconfirmed: Talos does not say how many recipients called or lost money.
- A Staples notice from support@orders.staples.com listed helpline 806 283 7712 beside an iPad order.
- A Dell notice for Microsoft Project Standard 2024 totaling $736.09 listed helpline 808 232 6397.
- The desired action was a phone call, not a click on a phishing link.
- Talos has tracked abuse of more than 25 legitimate platforms in the past year.
Impact: Lures victims into phone scams using trusted order emails
- 1.Flag unexpected phone numbers, URLs and support text in order-notification fields.
- 2.Correlate notification content with account history, payment state and known support channels.
- ATT&CK
- T1566 Phishing
- Organizations
- Cisco TalosStaplesDell
From the original article
9 min read at blog.talosintelligence.com
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.
By Diana Brown · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.