Order-tracking app Shop abused to push callback phishing attacks
Summary
Threat actors are exploiting Shopify's order-tracking app, Shop, by injecting fake purchase receipts into users' order histories. This tactic aims to trick users into divulging sensitive information or installing remote access software, representing a new avenue for phishing attacks.
IFF Assessment
This article describes a new method for tricking users into compromising their data or systems, which is detrimental to cybersecurity defenders.
Defender Context
Defenders should be aware of this emerging tactic where legitimate-looking order tracking apps can be leveraged for phishing. Users need to be educated to scrutinize unexpected order notifications and verify their authenticity through official channels rather than clicking on links or provided information within the app's less-trusted sections.