Hackers Leveraged Shopify Oder-Tracking App Shop to Push Fake Invoices

Researchers and user reports describe a scam in which attackers place fraudulent orders/receipts inside the Shopify "Shop" order-tracking app (via email parsing, merchant workflows, or other abuse) to create urgency and trick victims into calling a provided phone number; the callers then use social engineering to collect payment information, credentials, one-time codes, or obtain remote access. The technique leverages the trust users place in the app's order UI and has been observed across multiple brands and victim reports.