Scammers Abuse Shopify to Send Fake Invoices and Steal Credentials via Fake Support Calls

Security researchers have identified campaigns abusing the Shop app to inject fake order receipts that display fraudulent support phone numbers and high‑value items to trick users into calling attackers; the scams escalate to vishing, credential and payment data theft, or remote‑access installs, and appear to exploit legitimate platform features rather than a direct Shopify breach.