The Shop app from Shopify, which aggregates order tracking and receipts from multiple retailers, is being exploited by threat actors who add fake purchase receipts to users' order histories. These fake receipts impersonate brands like Norton, McAfee, Apple, and PayPal and include phone numbers that connect victims to scammers. The scammers use callback phishing techniques to obtain account credentials, payment card details, and OTPs, and sometimes convince victims to install remote access software. The fraudulent receipts appear alongside legitimate orders, increasing their credibility. The source of the fake receipts is unclear, with possibilities including email parsing or account association, but no definitive delivery channel has been identified. There is no indication that Shop or Shopify infrastructure has been breached.

Users of the Shop app may be deceived into providing sensitive personal and financial information or installing malicious software that grants remote access to their devices. This can lead to account compromise, financial fraud, and unauthorized device control. The phishing attacks exploit user trust in the legitimate app, increasing the likelihood of successful social engineering. No direct compromise of Shop or Shopify systems has been found, indicating the threat arises from external manipulation of order data sources.

No official patch or fix is available as this is a phishing abuse of the app's order display functionality rather than a software vulnerability. Users are advised not to call phone numbers listed on suspicious receipts and to verify any unexpected charges directly with their banks. Those who have disclosed sensitive information should immediately reset passwords and contact their card issuers to cancel affected payment methods. Monitoring for suspicious orders and educating users about callback phishing risks can help reduce impact. Since the vendor has not confirmed any compromise or fix, patch status is not yet confirmed — check vendor advisories for updates.