Cyberattackers are now hijacking legitimate order emails from major retailers like Dell and Staples to disguise fraudulent instructions inside genuine transaction details. Rather than crafting a fake email, they manipulate parts of actual notifications—such as billing or shipping segments—to fool recipients into placing calls to phone numbers controlled by attackers. The goal: get the target to initiate contact and compromise payment data or credentials.
Researchers from Talos have documented two related campaigns involving about 1,400 such messages as of October 21, 2026. The findings reveal this isn’t run-of-the-mill phishing—it’s a hybrid threat that blends legitimate emails with embedded fraud. Over the past year, the abuse has spread across more than 25 trusted platforms, spanning domains from retail to services, suggesting a growing trend in “platform-as-a-proxy” scams.
How the Scam Works
One example mimics an email from Staples, detailing an Apple iPad purchase with price, billing, delivery info, an order number, and all standard formatting. But hidden inside the shipping or billing fields are instructions prompting the recipient to call a provided support line. Dell’s version pulls off the same trick: a Microsoft Project Standard 2024 purchase labeled at $736.09, with genuine logo, order reference, and footer, but tainted content in the order confirmation that signals a helpline—again to a number controlled by the scammer.
These messages don’t rely on links or attachments. They’re crafted so that login credentials, payment info, or remote access can be solicited once the victim reaches the scammer by phone. Since the email delivery passes through authentic systems—complete with correct DKIM signatures and valid DMARC checks—the messages appear fully legitimate to most security systems and users.
Why Security Tools Mislead
Standard email authentication methods like SPF, DKIM, and DMARC help confirm who sent a message and if it came through expected infrastructure. However, they don’t ensure that content inside a billing address or order field is legitimate. Talos terms this issue “platform-as-a-proxy” abuse—attackers exploit user-controlled fields during registration or order processes, which then get echoed unfiltered in system-generated emails, making the message seem valid.
In one scenario, a person registers using a custom name or company filled with misleading instructions. Automated emails delivering that registration data then unwittingly carry instructions or phone numbers directing users to call scam lines. The same method is now being used in purchase alerts from retailers.
Indicators & Best Practices
Researchers have listed several indicators of compromise (IoCs) including specific scam phone numbers like 806 283 7712 (Staples) and 808 232 6397 (Dell), senders like [email protected] or [email protected], and order or purchase refs such as 9939818875 (Staples) or 2009829958247 (Dell). Also watch for billing or shipping fields containing unexpected phone numbers or support instructions. Urgent language and odd contact info within these segments are immediate red flags.
Recommendations include having systems validate user-supplied fields both at the time of input and before automated email generation. Email gateways should inspect full messages—especially nested content sources—not just trust the outer sender or authentication signatures. Unexpected or suspicious contact instructions embedded in otherwise routine communications deserve more scrutiny.
Retailer notifications will likely remain a rich canvas for social engineering because consumers expect certain transactional messages from vendors. As attackers refine ways to inject malicious content inside legitimate frameworks, detection becomes harder. This kind of scam adds pressure on security teams: traditional DMARC/DKIM validation isn’t enough when content gets abused downstream.
What this means: organizations must assume that authenticity of sender + authentication ≠ safety. Moving forward, defense strategies need to evolve to inspect and sanitize the content in fields that appear inside system-generated emails. Users should double-check unexpected order details and avoid calling numbers that look suspicious—even in familiar messages. The risk isn’t just a dodgy link anymore: the attack lives in the details of the receipt.
