Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
Cisco Talos reports that malicious actors abused legitimate email pipelines from Staples and Dell to push victims toward fraudulent phone numbers, bypassing traditional email security checks.
Key points
- Over 1,400 messages abused Staples and Dell transactional email workflows in observed campaigns.
- Attackers inserted fake helpline numbers into shipping and billing fields of legitimate order confirmations.
- Messages passed DKIM and DMARC authentication, making them appear credible to recipients.
Attackers gain access to victims through social engineering by leveraging trusted retail email pipelines. They utilized the inherent trust of legitimate order notification workflows to insert fraudulent phone numbers. This approach allows them to move targets from email to voice calls, where further credential theft or payment manipulation can occur.
How it unfolded
- Cisco Talos observed abuse of more than 25 legitimate platforms in the past year, including collaboration and payment services.
- Two specific campaigns targeted Staples and Dell, generating roughly 1,400 malicious messages that mimicked order confirmations.
- Attackers embedded fake helpline numbers in fields normally reserved for shipping or billing information within these notifications.
Who is affected
Recipients of these order notifications are at risk because the messages appear to originate from trusted vendors. The attacks involved messages displaying plausible purchases for items such as Apple iPads or Microsoft Project licenses. Since the messages came from legitimate transactional pipelines, recipients were likely to trust the content and contact the provided numbers for resolution.
The fix
No software patch or vendor update has been confirmed for these specific campaign vectors because the abuse relied on manipulating content within legitimate workflows rather than exploiting a software vulnerability. Organizations must focus on user awareness and monitoring for unusual communication requests rather than waiting for a technical fix from the email providers.
What made it possible
Teams usually rely on email authentication protocols like DKIM and DMARC to verify sender identity. However, these checks only confirm that the message originated from a legitimate domain, not that the content is safe. Attackers exploit this gap by using valid transactional workflows to deliver malicious instructions. Check whether your organization treats all inbound support requests with suspicion, regardless of their source. Verify that users do not call numbers embedded in unsolicited order confirmations without independent verification.
What to do and how to stay safe: Staples
- Train users to recognize that legitimate vendors will not ask for sensitive information via phone numbers embedded in email bodies.
- Monitor for spikes in outbound voice calls or unusual help desk tickets related to order disputes or cancellations.
- Implement policies that require verification of any high-value order changes through official, pre-established contact channels.
- Review email logs for messages that pass authentication but contain unexpected phone numbers or urgent action requests.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attackers bypass DKIM and DMARC checks in these campaigns?
No, the messages passed DKIM alignment and DMARC checks because they used legitimate transactional email pipelines from Staples and Dell.
What was the primary goal of the attackers in these campaigns?
The attackers aimed to push recipients to call fraudulent helpline numbers embedded in the order notifications for further social engineering.
How many messages were observed in the Staples and Dell campaigns?
Cisco Talos observed roughly 1,400 messages across the two campaigns abusing Staples and Dell email workflows.
