Security researchers have uncovered a sophisticated social engineering campaign that weaponizes the legitimate Shopify Shop application itself to fabricate fraudulent orders and execute callback phishing attacks. This novel method moves beyond traditional spoofed emails, embedding malicious lures directly within a user's trusted order history.
In this attack chain, threat actors have found a way to inject fake, high-value purchase receipts into the order histories of Shop app users. Victims are then contacted via email or push notification from the genuine Shop service, alerting them to these fictitious transactions. The notifications are designed to create urgency, typically displaying a large charge and including a prominent customer service number for immediate dispute.
The scam relies on callback phishing. When the victim contacts the provided number, they reach a scammer posing as customer support. The goal is to extract sensitive data—such as login credentials, payment information, or personal details—or to manipulate the user into installing remote access software under the pretense of resolving the unauthorized order.
This tactic represents a significant evolution in phishing strategies. By abusing the notification system and data integrity of a legitimate platform, attackers circumvent common red flags like suspicious sender domains or poor formatting. The fraudulent alert appears as an organic event within the user's actual account, making it exceptionally convincing and hard for both users and automated filters to dismiss.
The incident underscores the ongoing security responsibility of platform providers to safeguard the integrity of user-generated data and transaction histories, which form the bedrock of user trust. It also demonstrates the persistent effectiveness of attacks that exploit human psychology rather than technical vulnerabilities.
Users targeted by this campaign are advised to exercise extreme caution. The primary recommendation is to never use contact information provided within a suspicious alert. Instead, individuals should independently open the official Shop app or visit the Shopify website directly to verify their genuine order history. Any discrepancies should be reported exclusively through official, verified support channels found on the platform's website or within the app itself, ensuring communication remains with legitimate service providers.
安全研究人員發現一宗精密的社會工程攻擊活動，其利用合法的 Shopify Shop 應用程式本身來偽造欺詐性訂單，並執行回撥釣魚攻擊。這種新穎的手法超越了傳統的偽造電郵，將惡意誘餌直接嵌入用戶受信任的訂單歷史記錄中。
在此攻擊鏈中，攻擊者找到方法將虛假的高價值購買收據注入 Shop 應用程式用戶的訂單歷史。隨後，受害者會透過真正的 Shop 服務收到電郵或推送通知，提示他們這些虛構交易。這些通知旨在製造緊迫感，通常顯示一筆鉅額扣款，並附有顯眼的客服電話號碼以供立即提出爭議。
此騙局依賴回撥釣魚手法。當受害者撥打提供的號碼時，會接通偽裝成客戶支持的詐騙者。其目標是竊取敏感資料——例如登入憑證、付款資訊或個人詳情——或以解決未授權訂單為藉口，誘騙用戶安裝遠程存取軟件。
此策略代表釣魚策略的重大演進。透過濫用合法平台的通知系統和資料完整性，攻擊者避開了常見的警訊，例如可疑的寄件者網域或粗糙的格式。該欺詐警報看起來如同用戶實際帳戶中的正常事件，使其極具說服力，無論是用戶還是自動過濾器都難以識別。
此事件突顯了平台供應商在保障用戶生成資料及交易歷史完整性方面的持續安全責任，這些是用戶信任的基石。同時也證明了利用人類心理而非技術漏洞的攻擊手法持續有效。
針對此攻擊活動的用戶，建議極度謹慎。首要建議是切勿使用可疑警報中提供的聯絡資料。個人應獨立開啟官方 Shop 應用程式或直接訪問 Shopify 網站，以驗證其真實訂單歷史。任何不符之處應僅透過平台網站或應用程式內的官方驗證支援管道報告，確保與合法服務提供者溝通。