Order-tracking app Shop abused to push callback phishing attacks

Threat actors are abusing the Shopify-provided Shop app by inserting fraudulent order receipts into users' order histories that include phone numbers for 'support' callbacks; victims who call are socially engineered into revealing credentials, payment information, OTPs, or installing remote-access software. Researchers observed impersonation of major brands (Norton, McAfee, Apple, PayPal), could not determine the delivery vector, and advise users to avoid calling numbers on suspicious receipts, verify charges with banks, reset compromised credentials, and contact card issuers if needed.