PhishingPublished 25 Jun 2026

Order-tracking app Shop abused to push callback phishing attacks

Source Bleeping Computer

remote

Description

Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. [...]

Impact

Users of the Shop app may be deceived into providing sensitive personal and financial information or installing malicious software that grants remote access to their devices. This can lead to account compromise, financial fraud, and unauthorized device control. The phishing attacks exploit user trust in the legitimate app, increasing the likelihood of successful social engineering. No direct compromise of Shop or Shopify systems has been found, indicating the threat arises from external manipulation of order data sources.

Defensive guidance

Users are advised not to call phone numbers listed on suspicious receipts and to verify any unexpected charges directly with their banks. Those who have disclosed sensitive information should immediately reset passwords and contact their card issuers to cancel affected payment methods. Monitoring for suspicious orders and educating users about callback phishing risks can help reduce impact.

References

bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Jun 2026, 19:46 UTC

References

Community reviews

Related threats