Threat actors are abusing Shopify's Shop order-tracking app by inserting fake purchase receipts into users' order histories. These fraudulent invoices impersonate brands like Norton, McAfee, Apple, and PayPal, and include phone numbers that connect victims to scammers posing as support agents. The scammers use social engineering to extract credentials, payment card details, and OTPs, or trick victims into installing remote access software. This callback phishing method is considered more effective than email-based fraud because users inherently trust the Shop app. No evidence of a compromise at Shopify or the impersonated companies has been found, and the exact delivery mechanism for the fake receipts remains unclear. Users are advised not to call numbers on suspicious receipts and to verify charges directly with their bank.
