A fake refund scam has targeted Shopify Shop app users for several months, with fraudsters impersonating refunds directly inside the app.
Huntress reports an ongoing fake refund scam aimed at users of Shopify's Shop app. The fraudsters operate directly within the app rather than via email, making the scam harder to spot. The activity has been observed over the past few months, and users should verify refund requests before acting.
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.
Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.
Group-IB linked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, to more than 100,000 phishing pages across 54+ countries between December 2025 and May 2026. After the FBI, Google, and Lumen's Black Lotus Labs seized core admin servers, a Shopify storefront, about $100,000, and thousands of domains under Operation Ghost Hook in June, over 700 new phishing domains appeared within a month. The kit offered 267 templates, adversary-in-the-middle MFA interception, WebSocket-based live operator communication, and SMS delivery via a Telegram affiliate ecosystem with more than 5,000 subscribers.