The email says your Apple iPad order from Staples is confirmed. It comes from Staples' real order system, passes DKIM and DMARC, and looks exactly like a genuine receipt. The only thing wrong with it is a line in the shipping details reading "Helpline 806 283 7712", and that number belongs to a scammer.
Cisco Talos researcher Diana Brown documents this and two related tricks in the original report. Talos says it has seen abuse of more than 25 distinct legitimate platforms over the past year, spanning collaboration, productivity, file-sharing, survey, payment and AI-related services.
The receipt is real, the helpline is not
Talos analyzed two campaigns abusing the transactional email pipelines of Staples and Dell, together roughly 1,400 messages. In the Dell version, an order notification for Microsoft Project Standard 2024 totaling $736.09 carried "Helpline 808 232 6397" and "Call Our Sales Team" in its Ship To and Bill To fields. DKIM passed for Dell infrastructure and DMARC passed for order.dell.com.
The goal is a phone call, not a click. An unexpected, expensive purchase creates urgency, and the embedded number looks like the fastest fix. Once the victim is on the line, Talos notes, the scam can move into social engineering, payment manipulation, credential theft or remote assistance fraud, the same callback pattern behind cases like a vishing call that turned one reset into a 100,000-file theft.
Talos's point is that the attacker never forged anything. They put their content into fields the retailer's own system then rendered into a trusted email. Authentication proved the message came from Staples or Dell. It said nothing about whether the phone number was legitimate.
Sign-up forms and bounces do the same job
The same reflection trick powers two other techniques Talos describes:
- List bombing as delivery. List bombing normally floods a victim's inbox with sign-up and subscription emails to bury real alerts. Talos has seen a subset of cases where the attacker types a lure, such as a cryptocurrency-themed message, into a name, company or project field, so the platform's own welcome or verification email carries it. Talos stresses this is not yet a broad industry shift.
- Bounce abuse. Delivery failure reports can include parts of the original message. Talos observed a mail delivery notification carrying a WeTransfer-themed file-sharing lure, made to look like routine mail-system noise that needed review.
Inspect what the trusted email actually says
Talos's advice splits between platform owners and defenders:
- Platforms should treat any user-controlled value rendered into an email template as untrusted, validate it before storage and again before rendering, and reject or flag phone numbers, URLs, markup and urgent support language in fields where they do not belong.
- Email gateways should inspect the fully rendered message, including personalization fields and nested MIME content, not just the sender. For bounces, parse the delivery report and run normal phishing, malware and URL analysis on whatever is returned inside it.
- Order notifications should be checked against account history, payment state and known support channels. A receipt with an unfamiliar support number deserves a second look.
For users, the rule is simple: never call a number printed inside an unexpected order email. Look up the retailer's support line yourself. As Talos concludes, the wrapper tells you where a message came from, not whether what it carries is safe.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.