Talos: Dell and Staples order mail used for callback phishing
October 22: Reports added Talos’s October 21 details, including specific order amounts, helplines, sender domains, and that post-call fraud was not confirmed.
Cisco Talos says about 1,400 genuine Dell and Staples order emails carried callback-scam numbers and still passed authentication.
Cisco Talos says attackers inserted scam callback instructions into genuine Dell and Staples order notifications so recipients would call attacker-controlled numbers about purchases they did not recognize. An October 21 Talos report described two campaigns totaling roughly 1,400 messages. Samples passed DKIM and DMARC because they were sent through retailer systems; Help Net Security also reports SPF passed. Talos called the activity phishing and phone fraud, not confirmed malware, and said follow-on fraud after calls was not established. Talos says it has seen abuse of more than 25 legitimate platforms over the past year.
- Two campaigns totaled roughly 1,400 messages, per Cisco Talos.
- Staples sample cited an Apple iPad order and helpline 806 283 7712.
- Dell sample cited a $736.09 Microsoft Project order and helpline 808 232 6397.
- GBHackers lists Staples order #9939818875 and Dell purchase ID 2009829958247.
- Talos tracked abuse of more than 25 legitimate platforms over the past year.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Cisco Talos reports about 1,400 Dell and Staples scam messages. · Cyber Security News
What each outlet adds
beyond the shared facts- Cyber Security NewsNames retailer senders and says malware was not confirmed.
- Help Net SecurityAdds SPF passage, list bombing, bounces, and a WeTransfer lure.
- GBHackersGives order and purchase IDs plus aligned DKIM domains.
- Organizations
- Cisco Talos
Coverage
oldest first · one row per article · UTC- · 3d ago
Cyber Security NewsFirst report
Scammers plant fake support numbers in real Dell and Staples emails
Cisco Talos linked about 1,400 messages in two campaigns that pass DKIM and DMARC because retailers send them.
- · 3d ago
Help Net Security
Attackers send authenticated phishing through Dell, Staples and other platforms
Cisco Talos saw about 1,400 Dell and Staples messages that planted callback numbers in order fields.
- · 3d ago
GBHackers
Scammers hide callback numbers in real Dell and Staples order emails
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks still passed.