Verify Order Notifications: Attackers Abuse Staples and Dell Email Pipelines
Threat researchers found that criminals are inserting scam phone numbers into legitimate retail transaction emails to bypass security filters.
Key points
- Cisco Talos observed abuse of more than 25 legitimate platforms in the past year.
- Attackers embedded fraudulent helpline numbers in Staples and Dell order confirmations.
- Messages passed DKIM and DMARC checks because they originated from trusted retail domains.
Cisco Talos researchers reported that adversaries are increasingly using trusted business infrastructure to deliver malicious content. The team observed this trend accelerating over the past year, with abuse spanning more than 25 distinct legitimate platforms. These services include collaboration tools, file-sharing sites, payment processors, and AI-related applications. Attackers are moving beyond traditional phishing domains to exploit the inherent trust users place in these established services.
The risk
The core risk involves the subversion of transactional email workflows. In recent campaigns, attackers abused Staples and Dell notification pipelines to send roughly 1,400 messages. The outer sender identity was legitimate, not a forged lookalike domain. Instead, the malicious element was embedded within the order details. Attackers placed suspicious phone numbers in fields typically reserved for shipping or billing information, creating a false sense of urgency around high-value purchases.
Who is exposed
Organizations using enterprise email infrastructure are exposed to these attacks. The Staples campaign originated from "[email protected]" and passed through Proton Mail, Microsoft 365, and other downstream systems. The Dell campaign used "[email protected]". Because these messages originated from legitimate retail domains, they bypassed standard authentication checks. Users receiving unexpected order confirmations for expensive items like iPads or software licenses are the primary targets.
Cost and compliance
The financial impact stems from social engineering rather than direct system compromise. The Staples message listed a plausible Apple iPad purchase, while the Dell notification showed a Microsoft Project Standard 2024 order totaling $736.09. Attackers used these high-value items to pressure recipients into calling embedded helpline numbers. This shifts the interaction from email to voice, where scammers can attempt credential theft, payment manipulation, or remote assistance fraud.
Our take on the response
Security teams must recognize that email authentication passing does not guarantee content safety. The Staples and Dell messages had aligned DKIM and passed DMARC, yet contained fraudulent instructions. Defenders should prioritize monitoring for anomalous order details within trusted templates. Relying solely on sender verification is insufficient when attackers leverage legitimate transactional pipelines to deliver social engineering payloads.
What defenders should look for
Teams should monitor email logs for transactional messages containing unexpected contact information. Check whether order confirmations include phone numbers in shipping or billing fields, which is atypical for standard retail notifications. Look for spikes in high-value purchase alerts that do not match internal procurement records. Containment moves include blocking the embedded phone numbers at the network gateway and alerting users to verify orders directly through official vendor portals rather than calling numbers found in email bodies.
Background: Social engineering
Social engineering is not separate from cyber attacks; it is a method used within them. While traditional attacks exploit software vulnerabilities, social engineering exploits human trust. Both aim to gain unauthorized access, but one targets code and the other targets people. Understanding this distinction changes how you defend your organization.
Read the full guide: Difference Between Social Engineering and Cyber Attack Explained
What to do and how to stay safe: Cisco Talos
- Verify unexpected order confirmations by logging into the vendor's official website directly, not via links or numbers in the email.
- Configure email security tools to flag transactional messages that contain phone numbers or urgent action requests in non-standard fields.
- Train employees to recognize that legitimate authentication results do not validate the content or intent of the message body.
- Monitor help desk tickets for sudden spikes in requests regarding unauthorized purchases or delivery issues.
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Staples and Dell emails fail email authentication checks?
No, the messages passed DKIM and DMARC checks because they originated from legitimate retail domains.
How many legitimate platforms did Cisco Talos observe being abused?
Researchers observed abuse across more than 25 distinct legitimate platforms in the past year.
What was the attacker's goal in these campaigns?
The goal was to push recipients to call attacker-controlled phone numbers for social engineering or fraud.
