Phishing Campaign Spoofs Dell and Staples Emails to Deliver Malware

Key Takeaways

• A sophisticated phishing campaign is leveraging legitimate Dell and Staples email systems.
• Attackers embed fraudulent instructions within genuine order notifications, prompting recipients to call scam phone numbers.
• This “platform-as-a-proxy” technique bypasses traditional email authentication methods like SPF, DKIM, and DMARC.
• The goal is to initiate phone-based fraud, potentially leading to payment theft, password compromise, or remote assistance scams.

Attackers Hijack Trusted Retailer Systems for Phishing

Cybercriminals have devised a cunning phishing strategy, exploiting the trusted email infrastructure of major retailers Dell and Staples. Rather than sending fabricated emails, these attackers inject deceptive instructions directly into legitimate order confirmation messages. The sophisticated approach leverages the retailers’ automated notification systems to deliver scam directives, compelling recipients to contact attacker-controlled phone numbers under the guise of customer support.

The malicious emails typically describe high-value purchases that recipients are unlikely to have made. The primary objective is to provoke a sense of urgency and alarm, driving individuals to call a purported support line to dispute or cancel the unfamiliar order. Because the messages originate from and are delivered by the legitimate retailer’s system, they exhibit authentic sender details and design, lending significant credibility to the embedded scam content.

Cisco Talos researchers identified two distinct campaigns employing this method, encompassing approximately 1,400 messages, as detailed in an October 21 report by Diana Brown. While the research primarily focuses on phishing and phone-based fraud, rather than direct malware delivery, Talos noted similar abuses across more than 25 legitimate platforms over the past year, spanning various service categories.

Exploiting Dell and Staples Notifications

One campaign sample involved a Staples notification concerning an Apple iPad purchase. This email included standard elements such as an order number, delivery specifics, pricing, billing information, and the retailer’s typical footer. However, the deceptive instructions were strategically placed within fields traditionally reserved for shipping or billing data. This tactic mirrors other scams, like those involving Microsoft Teams notifications, where trusted branding is used to conceal dangerous directives leading to fraudulent support calls.

A Dell example followed an identical pattern, detailing the purchase of Microsoft Project Standard 2024 for $736.09. Its shipping and billing sections contained legitimate-looking order confirmation language alongside a fraudulent helpline number. This integration made the scam phone number appear seamlessly integrated into an established sales process, rather than an external fraud attempt.

Crucially, neither of these examples relied on tricking recipients into clicking an obvious phishing link. The intended next action was always a phone call. Once the interaction shifts from email to a phone conversation, attackers gain a direct channel to attempt various forms of fraud, including payment theft, password compromise, or initiating remote assistance scams. Talos’s report did not specify the exact follow-on actions that occurred in these particular campaigns.

Further reinforcing the illusion of legitimacy, the Staples message demonstrated valid DKIM authentication and passed DMARC checks. Similarly, Dell’s infrastructure passed DKIM, and its order domain passed DMARC. These authentication results confirmed the messages’ genuine origin from the retailers’ systems but did not, however, validate the authenticity of the purchase details or the embedded support instructions. This vulnerability is akin to weaknesses observed in GitHub and Jira notifications, where malicious content is inserted into fields that legitimate services subsequently include in automated communications.

Why Email Authentication Fails to Prevent These Scams

Talos refers to this technique as “platform-as-a-proxy” abuse. In this scenario, the attacker provides the misleading content, while a trusted service inadvertently facilitates its delivery. This distinction is critical for understanding email security. While protocols like SPF, DKIM, and DMARC are effective in verifying the legitimacy of the sending infrastructure, they are not designed to scrutinize the semantic content within an email. They cannot determine if a shipping field should contain cancellation instructions, if a purchase transaction is genuine, or if a listed phone number truly belongs to the retailer.

The researchers also documented “registration abuse,” where attackers input scam text into fields such as name, company, or project during a legitimate service registration. Automated welcome messages then propagate this malicious text to recipients. In certain instances, this can escalate beyond mere inbox clutter, transforming legitimate registration emails into conduits for attacker-controlled messages. This phenomenon, along with related email bombing support scams, highlights how creating inbox confusion can effectively support social engineering efforts, though these may involve different operators.

Talos additionally observed a WeTransfer-themed lure embedded within a delivery failure notification, demonstrating the breadth of this problem across various forms of automated email content.

What You Should Do

• Verify Unexpected Orders: If you receive an order confirmation for a purchase you didn’t make, do not call the number provided in the email. Instead, independently navigate to the retailer’s official website or use a known customer service number to verify the order.
• Scrutinize Email Content: Be wary of urgent language, unexpected phone numbers, or support instructions embedded within fields typically used for shipping or billing information, even in seemingly legitimate emails.
• Enhance Email Security Gateways: Organizations should configure their security gateways to perform deep content inspection of all incoming messages, including content nested within automated notifications and delivery reports, rather than relying solely on sender authentication.
• Implement User Field Validation: Service providers should implement robust validation checks on user-controlled fields, both before storing data and again before generating automated emails, to prevent the injection of malicious content.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.