Attackers Exploit Trust in Legitimate Infrastructure for Social Engineering Scams
Threat actors are increasingly subverting trusted transactional email pipelines from major retailers like Staples and Dell to deliver social engineering scams, bypassing traditional security measures.
Legitimate infrastructure, once a bastion of trust, is now being systematically weaponized by attackers to deliver malicious content and conduct scams. Cisco Talos researchers have observed a significant acceleration in this trend, with threat actors increasingly abusing Software-as-a-Service (SaaS) platforms and transactional email pipelines. In the past year alone, Talos tracked abuse across more than 25 distinct legitimate platforms, including collaboration, productivity, file-sharing, payment, and AI-related services. This indicates a strategic shift away from traditional phishing tactics towards exploiting the inherent credibility of established business tools.
A recent analysis by Talos uncovered two distinct campaigns that leveraged the transactional email pipelines of major retailers Staples and Dell. These campaigns, collectively responsible for approximately 1,400 observed messages, did not rely on forged sender identities or lookalike domains. Instead, the malicious element was embedded within the content of otherwise legitimate order notification workflows, specifically within fields typically used for shipping or billing information. The attackers' objective was to create a sense of urgency around a high-value, unexpected purchase and then direct recipients to an attacker-controlled phone number.
In one campaign, a message appeared as a legitimate Staples order confirmation for an Apple iPad. While the email featured standard Staples branding, order details, and footer content, it embedded a suspicious "Helpline" phone number within the order details section. The attackers aimed to trick recipients into believing an expensive order had been placed and that the quickest resolution was to call the provided number. Once on the phone, victims would be subjected to social engineering tactics, potentially leading to credential theft, payment manipulation, or remote assistance fraud.
The technical sophistication of these attacks is highlighted by their ability to bypass authentication checks. The Staples message, for instance, showed DKIM alignment for "orders.staples.com" and passed DMARC for the visible Staples domain. The message also successfully navigated through multiple forwarding and re-encapsulation paths, including Proton Mail and Microsoft 365, before reaching enterprise mail infrastructure. While these hops complicate provenance analysis, they underscore how authentication mechanisms, designed to verify sender legitimacy, offer no assurance regarding the authenticity of the embedded transaction or contact information.
A similar campaign was observed using Dell's order notification system. This message, appearing as a Dell order confirmation for Microsoft Project Standard 2024, also embedded a "Helpline" phone number within the "Ship To" and "Bill To" sections. The psychological manipulation was identical: an unexpected, high-value purchase presented through a familiar and trusted retail template, with a phone number positioned as the immediate path to resolution. The attacker exploited Dell's established brand credibility to redirect victims to their own fraudulent contact channels.
As with the Staples example, the Dell message's headers indicated passing DKIM and DMARC checks for Dell-related infrastructure. The message also exhibited forwarding artifacts as it traversed various mail servers. This demonstrates that the malicious intent was not in a trivially forged sender address but hidden within the rendered content of a legitimate transactional workflow. This tactic represents a trust-boundary failure, where attackers leverage the trusted delivery mechanism of commerce infrastructure to execute their scams.
From a defensive standpoint, while sender authentication protocols like SPF, DKIM, and DMARC are crucial for verifying message origin, they are insufficient on their own. These protocols confirm that a message originated from expected infrastructure but cannot validate the legitimacy of the transaction details, the business logic of the rendered fields, or whether the user is being coerced into an attacker-controlled action. This highlights the need for deeper content inspection and validation within transactional emails.
Cisco Talos recommends that organizations treat order notifications and similar transactional messages as sensitive content. Any field reflected into such messages—whether it's a shipping name, billing address, order note, or support detail—can potentially become a delivery vehicle for malicious content if not rigorously validated before rendering. Retailers and security teams must implement stricter validation processes for all fields within transactional communications to prevent their infrastructure from being subverted into attack pipelines.