MEDIUMPhishing
Global

Order-tracking app Shop abused to push callback phishing attacks

·Source: BleepingComputer

Updated:

Executive Summary

Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. [...]

Analysis

Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. [...]
Source Attribution

Originally published by BleepingComputer on Jun 25, 2026.

Related Threats

LOWPhishing

FBI: Russian hackers now target Signal backup recovery keys

The FBI and CISA are warning that a phishing campaign targeting Signal users tied to Russian intelligence services has evolved to steal Signal Backup Recovery Keys, allowing attackers to access victims' historical messages. [...]

BleepingComputer
MEDIUMPhishing

FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have added a step: they now coax targets into handing over their Signal Backup Recovery Key. Hand it over once, and the attacker can restore the account's backup, read the private and group message history, and take over the account. Worse, the key keeps working.

The Hacker News
MEDIUMPhishing

Russian Intelligence Services Continue to Target Commercial Messaging Applications

<p>CISA and the Federal Bureau of Investigation (FBI) issued an updated <a href="https://www.ic3.gov/PSA/2026/PSA260626" target="_blank">Public Service Announcement (PSA)</a> warning of Russian Intelligence Services (RIS) cyber threat actors targeting commercial messaging applications in ongoing phishing campaigns. This PSA is an update to the March 2026 <a href="https://www.cisa.gov/resources-too

CISA Advisories