Shop Order‑Tracking App Abuse Fuels Callback Phishing Attacks
Notify users to ignore any receipt they did not place and verify charges directly with their bank; do not call the phone number listed.
Notify users to ignore any receipt they did not place and verify charges directly with their bank; do not call the listed phone number.
Summary
Threat actors are exploiting the Shopify Shop app by inserting fake purchase receipts into users’ order histories, tricking them into revealing sensitive data or installing remote access software. The app, with 50 million Google Play downloads and 7 million Apple App Store ratings, lets users track orders from multiple retailers and view receipts, making it a trusted platform for fraudsters.
Gen Digital researchers found fake receipts that impersonate brands such as Norton, McAfee, Apple, and PayPal, each containing a phone number that scammers pose as support agents. Victims are lured into disclosing credentials, payment card details, OTPs, and in some cases installing software that grants remote device access. No compromise of the Shop app, Shopify, or the impersonated companies was detected.
Users who see receipts for orders they did not place should not call the listed phone number but verify any alleged charge directly with their bank. Those who have already provided information should immediately reset passwords and contact their card issuer.
Key changes
- Fake purchase receipts inserted into Shop app
- Receipts impersonate brands like Norton, McAfee, Apple, PayPal
- Receipts include a phone number posing as support
- Scammers use social engineering to steal credentials, payment details, OTPs
- Some victims are tricked into installing remote access software
- Gen Digital found no compromise of Shop or Shopify
- Shop aggregates orders from email parsing, account association, order workflows
- Users advised not to call phone number and verify with bank