Scammers hide callback numbers in real Dell and Staples order emails
Original title: Scammers Exploit Dell and Staples Order Emails to Bypass Traditional Phishing Detection
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks still passed.
Cisco Talos says scammers abused legitimate Dell and Staples order notifications to plant callback-phishing helpline numbers inside transactional emails that passed authentication. Across two campaigns, Talos observed roughly 1,400 messages. A Staples notice from orders.staples.com described an Apple iPad order and put “Helpline 806 283 7712” in shipping or billing fields. A Dell notice for Purchase ID 2009829958247 described a $736.09 Microsoft Project Standard 2024 purchase and included “Helpline 808 232 6397.” Both aimed to move recipients to phone calls. Talos says follow-on fraud, credential theft, or remote-assistance activity was not established.
Unconfirmed: Talos says the findings do not establish which follow-on fraud or theft actions occurred.
- Staples DKIM aligned for orders.staples.com and DMARC passed; Dell DKIM and DMARC for order.dell.com also passed.
- The Staples subject referenced order #9939818875.
- Talos says it has tracked abuse of more than 25 legitimate platforms over the past year.
- Talos advises recipients not to call numbers supplied in unexpected purchase notices.
Impact: Callback lures inside authenticated retail order emails
- 1.Verify unexpected purchases through retailer accounts or known support channels, not numbers in the email.
- 2.Retailers should validate user-controlled order fields before rendering them in notifications.
- Organizations
- Cisco Talos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | order.dell.com | ted infrastructure also passed DKIM, while DMARC passed for order.dell.com. By inputting a “hostile string” such as a cryptocurrency-t |
| domain | orders.staples.com | d The Staples sample showed aligned DKIM authentication for orders.staples.com and a passing DMARC result. Dell-related infrastructure als |
From the original article
3 min read at gbhackers.com
Scammers are abusing legitimate Dell and Staples order notifications to deliver callback phishing lures, embedding fraudulent helpline numbers inside transactional emails that pass authentication checks. Cisco Talos observed roughly 1,400 messages across two campaigns, highlighting how trusted retail infrastructure can carry attacker-controlled instructions without relying on spoofed senders or malicious links.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.