Hackers Leveraged Shopify Oder

Cybersecuritynews •Tushar Subhra Dutta • June 26, 2026

Hackers are no longer waiting in your inbox. A newly identified scam technique places fake invoices directly inside shopping app order histories, making them feel more credible than a typical phishing email. Researchers have observed fraudulent receipts appearing inside the Shop app, the popular order-tracking application from Shopify, catching users off guard in a space […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shopify's Shop App Targeted by Callback Phishing Scams Threat actors are exploiting Shopify's Shop app to insert fake purchase receipts into users' order histories, tricking them into revealing sensitive information or installing malicious software. The app, popular in North America with 50 million downloads, has seen scammers impersonating reputable brands like Norton and PayPal. Victims are misled into calling a fraudulent support number listed on these receipts, where scammers attempt to extract account credentials and payment details. Researchers from Gen Digital have identified this shift from traditional email phishing to in-app attacks as particularly effective due to the inherent trust users place in the app. Although the exact method of how these fake receipts are inserted remains unclear, no evidence suggests that Shopify or the impersonated companies have been compromised. Users are advised to verify any suspicious receipts directly with their banks and to reset passwords if they have already engaged with the scammers. 7 sources 62

Extracted Entities

Hackers Leveraged Shopify Oder

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)