Legitimate Service Abuse: Over 25 Platforms Repurposed for Fraud and Phishing Delivery

1. Basic Information

• Article Title: Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
• Publisher: Cisco Talos
• Publication Date: 2026-10-21
• Original Source: Cisco Talos
• Related Sources: None
• Related Malware: None
• Related Threat Groups: None
• Related CVEs: None
• Related Products: Staples order notification, Dell order notification, Microsoft 365, Proton Mail
• Severity: High

2. Executive Summary

Cisco Talos reported tracking the abuse of more than 25 legitimate platforms, including collaboration tools, file-sharing services, surveys, payment systems, and AI platforms. They observed approximately 1,400 messages across two campaigns that embedded fake phone numbers into legitimate order notifications.

3. Attack Flow

Abuse of Legitimate Order Notifications

Step	Normal Workflow Behavior	Attacker Abuse Action	Defender Identification Points
Order and Billing Input	Accepts shipping and billing information	Embeds fake helpline numbers into address or name fields	Unusual phone numbers or text in free-form input fields
Notification Delivery	Sends DKIM-signed notifications from legitimate domains (DMARC also passed in the sample)	Exploits trust from legitimate infrastructure and passed authentication	Sender authentication passes, but email body content is suspicious
Victim Guidance	Presents order completion and shipping notices	Urges cancellation due to false high-value purchases and prompts phone contact	Unfamiliar high-value charges and urgent requests for contact
Expected Subsequent Fraud (Success Unconfirmed)	Appearance resembling legitimate support channels	Aims for fraud or remote access tool deployment after calling the fake number	Phone calls, money transfers, credential leaks, and tool launches require separate evidence

1. The attacker inputs malicious shipping or billing details into a legitimate order workflow.
2. An order notification with a DKIM signature arrives from a legitimate domain to the recipient, and DMARC validation also passed in the sample analyzed by Talos.
3. Unfamiliar high-value purchase details and a fake helpline phone number create a sense of urgency for the recipient.
4. The recipient is guided to a fake phone support channel, aiming for credential theft or unauthorized money transfers after the call. The number of successful fraud outcomes after phone contact has not been publicly disclosed.

4. Attacker Position and Execution Location

• Attackers abuse input interfaces in legitimate SaaS, retail, and payment workflows.
• Messages arrive at the recipient side as legitimate, authenticated emails sent from legitimate senders.

5. Appearance to Victims and Administrators

Victims

• Displayed as an unfamiliar high-value order notification accompanied by a fake phone number for cancellation.

Administrators

• Both samples analyzed by Talos passed DKIM and DMARC validation, blending in with standard order notifications. An SPF pass was not established as a finding common to both samples.

6. Success and Failure Conditions

Success Conditions

• Users of the legitimate workflow can input arbitrary text or phone numbers into fillable fields.
• The recipient trusts the contact information listed in the notification email and initiates contact.

Failure Conditions and Mitigations

• Limit input values in templates and implement proper sanitization.
• Verify brand patterns against the phone numbers listed on the recipient side.
• Users should check their order history through the official website rather than using the contact information in the notification.

7. Outcomes upon Success

• Social engineering via phone calls, unauthorized money transfers, and credential theft.
• Risk of deploying remote support tools and subsequent malware infections.

8. Observable Logs

Inference: The following are candidate logs to check within your own organization. They depend on configuration settings, retention periods, and monitoring scopes, and are distinct from cases where the information source observed each event.

• Email: Notification emails arriving from legitimate senders that pass DMARC but contain suspicious phone numbers
• Proxy / SWG / DNS: None
• Endpoint / EDR: Remote support tools installed after phone interactions
• Identity / IdP: Abnormal logins occurring during or immediately after phone interactions
• SaaS / Cloud: High-volume or abnormal input transactions in legitimate workflows
• Network: Traffic associated with remote assistance tools

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed) (contact_only): Public info: Talos observed about 1,400 messages across two campaigns. Receipt alone does not equal successful fraud.
• User Action Confirmed (user_action): Criteria: Confirmation of an outgoing call to the number in the notification. Talos has not disclosed the number of successful fraud outcomes after phone contact.
• Data or Session Compromise Confirmed (data_or_session_compromise): Criteria: Confirmation that credentials were handed over to the attacker or that an unauthorized session was established. Money transfers or the deployment of remote assistance software alone do not prove this stage.

10. Investigation Playbook

• Trigger: Abnormal order notifications from legitimate senders or unknown phone numbers within the body
• Initial Check: Review email headers, template fields, and recipient scopes
• Endpoints: Check for the presence of remote support tools or browser sessions
• Authentication/Cloud: Check for immediate login history or MFA setting changes
• Subsequent Actions: Check for unauthorized money transfers, credential resets, or malware infections
• Containment: Isolate the relevant notification, block the phone number, protect accounts, and report unauthorized use to the service provider
• Judgment Category: Notification received / User contact / Credential theft / Financial loss

11. Defense and Detection Ideas

• Single Event: Phone numbers listed that do not match official brand templates, or combinations of high-value orders and urgent cancellations
• Time-Series Correlation: Notification received -> Phone call placed -> Remote tool deployed -> Abnormal login
• Hunting Perspective: Searching for emails sent from legitimate senders that contain the same suspicious phone number
• Log Gaps: Lack of call recording data and vendor-side input logs
• Prioritized Mitigations: Strengthened content inspection, input validation for workflows, and user awareness training

12. Facts / Inference / Hypothesis

Facts

• Talos observed the abuse of over 25 legitimate platforms over the past year.
• Approximately 1,400 messages were observed across two campaigns abusing Staples and Dell order notifications.
• Malicious phone numbers and text were embedded in shipping or billing fields.
• The Staples case passed DKIM alignment and DMARC validation.
• The goal of the attack is to guide victims to phone calls, transitioning into social engineering, unauthorized money transfers, credential theft, and remote assistance fraud.

Inference

• Email sender authenticity and content safety must be clearly separated, requiring inspection of field contents and action requests even from legitimate senders.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1566	Phishing	high	Repurposes the legitimate notification pipeline for phishing delivery.
T1598	Phishing for Information	medium	Targets credentials and payment information via phone calls.

14. Unknowns and Further Investigation

• Abuse volumes and success rates across each of the 25+ platforms cannot be uniformly compared based on current public information.
• The actual success count of fraud following phone redirection has not been confirmed.

15. Impact on SOCs and Organizations

Organizations operating e-commerce, billing, file-sharing, survey, or payment-notification workflows may face similar abuse if user-controlled content is included in notifications to third parties without sufficient validation. Do not treat DKIM/DMARC passes as a safety determination; instead, verify order details, phone numbers, external contact requests, and official brand patterns.

16. Summary by Target Audience

• For SOCs: Even for notifications from legitimate senders, inspect phone numbers within email body fields, emphasis on urgency, high-value purchase descriptions, and forwarding chains.
• For Administrators: Restrict user-controllable inputs, character lengths, URLs, and phone numbers in notification templates, and establish an abuse-reporting channel.
• For Users: Do not directly contact numbers listed in unfamiliar order notifications; verify through official websites or authorized contact channels.