Introduction to Shop App Abuse
The Shop digital shopping assistant, developed by Shopify, has been abused by threat actors to push callback phishing attacks. The app, which serves as a centralized platform for users to track orders from multiple online retailers, access receipts and shipping updates, and discover products from merchants using Shopify, has become a popular target for scammers.
With over 50 million downloads on Google Play and 7 million ratings in Apple's App Store, the Shop app is widely used in North America. However, its popularity has also made it an attractive target for threat actors, who are increasingly using the app to trick users into providing sensitive data or installing remote access software.
Modus Operandi of the Scammers
According to cybersecurity company Gen Digital, scammers are inserting fake orders that appear alongside legitimate purchases, impersonating brands such as Norton, McAfee, Apple, and PayPal. These fake orders are designed to look like real purchase receipts, complete with a phone number that users can call to dispute the purchase.
However, when users call the listed phone number, they are connected to a scammer posing as a support agent. Using social engineering tactics, the fraudster attempts to convince the victim to disclose account credentials, payment card details, and temporary authentication codes (OTPs). In some cases, victims are even tricked into installing software that grants remote access to their device.
Why the Shop App is an Effective Target
Gen Digital researchers note that the Shop app is a more effective target for callback phishing attacks than email, as users inherently trust the app and are more likely to respond to orders that appear within it. Additionally, the app's ability to populate orders from multiple sources, including email parsing, account association, and order workflows, makes it easier for scammers to insert fake receipts.
However, despite the effectiveness of this tactic, many of the false receipts contain poor grammar, which can serve as an obvious red flag for users. Nevertheless, the fear of a large, unauthorized purchase can lead users to overlook these mistakes and respond to the scammer.
Investigation and Response
Despite the observed wave of fraudulent invoices, it is unclear how they are being inserted into the Shop app. Gen Digital researchers were unable to confirm a specific delivery channel for the fraudulent notifications, and it is unclear whether the scammers are using a vulnerability in the app or exploiting user behavior.
Gen Digital underlines that they found no evidence that Shop, Shopify, or any of the impersonated companies were compromised. BleepingComputer has reached out to Shopify for comment, but as of publishing, no response has been received.
In the meantime, users who see receipts for orders they didn’t place on Shop are advised not to call the phone number listed on them. Instead, they should verify any alleged charge directly with their bank. Those who have already contacted the scammers and disclosed sensitive information should immediately reset their account passwords and contact their card issuer for cancellation.
Prevention and Mitigation
To avoid falling victim to these types of scams, users should be cautious when responding to orders or receipts within the Shop app. They should verify the authenticity of any purchase or receipt, and be wary of any requests for sensitive information or requests to install software.
Additionally, users should keep their operating system, browser, and other software up to date, and use antivirus software to protect against malware. By being vigilant and taking these precautions, users can reduce their risk of falling victim to callback phishing attacks and other types of scams.
Source: BleepingComputer