Firibgarlar qayta qo'ng'iroq qilish fishing tuzoqlarini yetkazish uchun haqiqiy Dell va Staples buyurtma bildirishnomalaridan foydalanmoqda, tranzaksion elektron xatlarda firibgar yordam liniyasi raqamlarini joylashtirib, ular autentifikatsiya tekshiruvlaridan o'tadi.
Cisco Talos ikki kampaniya bo'yicha taxminan 1 400 xabar kuzatdi, bu ishonchli chakana savdo infratuzilmasi qanday qilib hujumchi nazoratidagi ko'rsatmalarni soxta yuboruvchilar yoki zararli havolalarga tayanmasdan yetkazishi mumkinligini ko'rsatadi.
Bu faoliyat kengroq naqshni davom ettiradi: Talos o'tgan yil davomida 25 dan ortiq haqiqiy platformalarning suiiste'molini kuzatdi, ular hamkorlik, unumdorlik, fayl almashish, so'rovnomalar, to'lovlar va AI xizmatlarini qamrab oladi.
Staples kampaniyasi support@orders.staples.com manzilidan kelgan buyurtma tasdiqlovidan foydalangan, mavzu esa #9939818875 buyurtmaga ishora qilgan.
Uning professional formatlangan matni Apple iPad xaridini tasvirlagan, narx, yetkazib berish ma'lumoti, to'lov tafsilotlari va standart korporativ brending bilan birga.
Biroq odatda jo'natish yoki to'lov ma'lumotlari uchun mo'ljallangan maydonlarda "Helpline 806 283 7712" va "Order Confirmed" yozuvlari joylashtirilgan.
Bu kiritilgan ko'rsatmalar kutilmagan xariddan xavotirlangan qabul qiluvchilarni rasmiy kanallar orqali tekshirish o'rniga hujumchiga qo'ng'iroq qilishga undagan.
Dell kampaniyasi ham xuddi shu modelni kuzatgan. Buyurtma bildirishnomasi Dell Purchase ID 2009829958247 va Microsoft Project Standard 2024 xaridiga ishora qilgan, umumiy summa $736.09.
Uning "Ship To" va "Bill To" bo'limlarida "Helpline 808 232 6397", "Confirmed Order" va "Call Our Sales Team" yozuvlari kiritilgan.
Har ikkala kampaniya qabul qiluvchilarni elektron pochtadan ovozli suhbatlarga o'tkazishni maqsad qilgan, bu yerda firibgarlar to'lov firibgarligi, ma'lumot o'g'irlash yoki masofaviy yordam firibgarligini amalga oshirishi mumkin.
Cisco Talos tadqiqotchilari aytishicha, dasturiy ta'minot-xizmat (SaaS) bildirishnoma quvurlarini qurollantirishda bu platformalar tobora zararli niyatlar uchun proksi sifatida qayta ishlatilmoqda.
Ta'minlangan natijalar keyingi harakatlar sodir bo'lganini aniqlamaydi.
Dell va Staples elektron xatlari suiiste'mol qilingan
Staples namunasi orders.staples.com uchun mos DKIM autentifikatsiyasini va o'tgan DMARC natijasini ko'rsatgan. Dell bilan bog'liq infratuzilma ham DKIM'dan o'tgan, DMARC esa order.dell.com uchun o'tgan.
Ism, kompaniya yoki sarlavha uchun mo'ljallangan maydonlarga "dushman satr" — masalan, kriptovalyuta mavzusidagi tuzoq — kiritish orqali hujumchi platformani bu ma'lumotni haqiqiy foydalanuvchi ma'lumoti sifatida qabul qilishga majbur qiladi.
Ro'yxatdan o'tish maydoni aks etishi (Manba: Cisco Talos).
Bu natijalar yetkazib berish kontekstini autentifikatsiya qiladi, xarid yoki kiritilgan telefon raqamlarining haqiqiyligini emas.
Staples misolida Microsoft 365 va Proton Mail kabi xizmatlar orqali yo'naltirish manba tahlilini murakkablashtirgan, lekin bu farqni o'zgartirmagan.
Mexanizm Talosning avvalgi platforma-proksi suiiste'moli tadqiqotiga o'xshaydi, bu yerda hujumchilar GitHub commit xabarlari va Jira loyihasi yoki taklif maydonlariga firibgarlik mazmunini kiritgan.
Ishonchli xizmatlar keyinchalik bu kiritmani autentifikatsiyalangan bildirishnomalarga kiritib, o'z obro'sini zararli ko'rsatmalarga berishgan.
Talos shuningdek, ro'yxatdan o'tish ish oqimlari hujumchi taqdim etgan ismlar, kompaniya tafsilotlari yoki loyiha sarlavhalarini avtomatlashtirilgan elektron xatlarga aks ettirishini tasvirlagan.
Tanlangan ro'yxat-bombardimon holatlarida bu pochta qutisini to'ldirishni faqat buzilish emas, balki maqsadli mazmun yetkazib berishga aylantiradi.
Yetkazib berish holati bildirishnomalari yana bir tashuvchi hisoblanadi. Qaytarilgan xabar tanalari yoki ichki MIME mazmuni aks holda haqiqiy yetkazib berish muvaffaqiyatsizlik hisobotlari ichida fishing tuzoqlarini saqlab qolishi mumkin.
Kuzatilgan bir misolda WeTransfer mavzusidagi tuzoq bo'lgan, garchi turli yetkazib berish mexanizmlari o'xshash ko'rinishdagi xabarlarni yaratishi mumkin.
Chakana savdochilar foydalanuvchi nazoratidagi maydonlarni saqlash va ko'rsatishdan oldin tekshirishi, bu qiymatlar tegishli bo'lmagan joylarda kutilmagan telefon raqamlari, URL manzillari yoki shoshilinch yordam ko'rsatmalarini belgilashi kerak.
Buyurtma bildirishnomalari to'lov holati, hisob tarixi, jo'natish konteksti va tasdiqlangan yordam kanallari bilan ham tekshirilishi kerak.
Xavfsizlik shlyuzlari yuboruvchi obro'si yoki autentifikatsiyaga faqat tayanmasdan, ko'rsatilgan HTML, oddiy matn, ilovalar, yo'naltirishlar va ichki MIME obyektlarini tekshirishi kerak.
Biznes konteksti tekshiruvlari manzil maydonlarida kiritilgan bekor qilish ko'rsatmalarini aniqlashi mumkin.
Bu infratuzilma autentifikatsiyasini tranzaksiya tekshiruvidan ajratadi — bu ikki nazorat tubdan turli xavflarni hal qiladi.
Qabul qiluvchilar kutilmagan xaridlarni shubhali bildirishnomalarda berilgan telefon raqamlari orqali emas, balki mustaqil ravishda kirilgan chakana savdo hisoblari yoki belgilangan yordam kanallari orqali tekshirishi kerak.
Asosiy muvaffaqiyatsizlik noto'g'ri ishonch: elektron xatning tashqi shaxsi haqiqiy bo'lsa ham, haqiqiy infratuzilma dushman mazmunini yetkazishi mumkin.
Scammers are abusing legitimate Dell and Staples order notifications to deliver callback phishing lures, embedding fraudulent helpline numbers inside transactional emails that pass authentication checks.
Cisco Talos observed roughly 1,400 messages across two campaigns, highlighting how trusted retail infrastructure can carry attacker-controlled instructions without relying on spoofed senders or malicious links.
The activity extends a broader pattern: Talos tracked abuse involving more than 25 legitimate platforms over the past year, spanning collaboration, productivity, file sharing, surveys, payments, and AI services.
The Staples campaign used an order confirmation appearing from support@orders.staples.com, with a subject referencing order #9939818875.
Its professionally formatted body described an Apple iPad purchase, complete with pricing, delivery information, billing details, and standard corporate branding.
However, fields normally reserved for shipping or billing information contained “Helpline 806 283 7712” and “Order Confirmed.”
These inserted instructions encouraged recipients alarmed by an unexpected purchase to telephone the attacker rather than investigate through official channels.
The Dell campaign followed the same model. An order notification referenced Dell Purchase ID 2009829958247 and a Microsoft Project Standard 2024 purchase totaling $736.09.
Its “Ship To” and “Bill To” sections included “Helpline 808 232 6397,” “Confirmed Order,” and “Call Our Sales Team.”
Both campaigns sought to move recipients from email to voice conversations, where scammers could potentially pursue payment fraud, credential theft, or remote-assistance scams.
Cisco Talos Researchers said that, on weaponizing software-as-a-service (SaaS) notification pipelines, these platforms are increasingly repurposed as proxies for malicious intent.
The supplied findings do not establish which follow-on actions occurred.
Dell and Staples Emails Exploited
The Staples sample showed aligned DKIM authentication for orders.staples.com and a passing DMARC result. Dell-related infrastructure also passed DKIM, while DMARC passed for order.dell.com.
By inputting a “hostile string” such as a cryptocurrency-themed lure into fields intended for a name, company, or title, the attacker forces the platform to treat this data as legitimate user information.
Registration field reflection (Source : Cisco Talos).
These results authenticated the delivery context, not the legitimacy of the purchase or embedded telephone numbers.
Forwarding through services including Microsoft 365 and Proton Mail in the Staples example complicated provenance analysis without changing that distinction.
The mechanism mirrors Talos’ earlier research into platform-as-a-proxy abuse, where attackers inserted scam content into GitHub commit messages and Jira project or invitation fields.
Trusted services subsequently incorporated that input into authenticated notifications, lending their reputation to malicious instructions.
Talos also described registration workflows that reflect attacker-supplied names, company details, or project titles into automated emails.
In selected list-bombing cases, this transforms inbox flooding into targeted content delivery rather than merely disruption.
Delivery status notifications offer another carrier. Returned message bodies or nested MIME content can preserve phishing lures inside otherwise legitimate delivery-failure reports.
One observed example contained a WeTransfer-themed lure, although different delivery mechanisms can produce similar-looking messages.
Retailers should validate user-controlled fields before storage and rendering, flagging unexpected telephone numbers, URLs, or urgent support instructions where those values do not belong.
Order notifications should also be checked against payment status, account history, shipping context, and approved support channels.
Security gateways need to inspect rendered HTML, plain text, attachments, redirects, and nested MIME objects rather than relying solely on sender reputation or authentication.
Business-context checks can expose cancellation instructions embedded in address fields.
This separates infrastructure authentication from transaction validation, two controls that address fundamentally different risks.
Recipients should verify unexpected purchases through independently accessed retailer accounts or established support channels, never through telephone numbers supplied in suspicious notifications.
The central failure is misplaced trust: legitimate infrastructure can deliver hostile content even when the email’s outer identity is authentic.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.