Scam Emails Bypass Filters Using Trusted Retail Systems
Attackers are injecting fraudulent instructions into verified order messages, exploiting trust in major corporate platforms.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you still trust order confirmation emails sent by major retailers to be secure?
Cisco Talos has identified 1,400 scam emails sent through the legitimate notification systems of Staples and Dell. This technique uses authenticated transactional messaging to deliver fraudulent support instructions.
Why it matters
The abuse of trusted transactional platforms complicates email filtering, as security systems are designed to trust these verified sources. This method exploits the existing infrastructure that businesses use to communicate with their customers.
Researchers observed attackers abusing 25 different platforms over the past year. These messages bypass traditional spam filters by originating from the infrastructure of trusted service providers.
The players
Cisco Talos
A threat intelligence organization that provides security research and operational data on global cyber threats.
Staples
A global office supply retail company that manages large-scale automated customer notification and order systems.
Dell
A multinational technology corporation that uses automated transactional messaging for hardware support and order delivery.
The details
Attackers leverage the authenticated nature of transactional emails—messages generated by a service provider like a password reset or an order status update—to bypass security checks. By inserting fraudulent support instructions directly into these legitimate workflows, malicious actors ensure the communication is delivered with the reputation of a trusted brand. This strategy relies on the fact that security gateways prioritize the domain reputation of major platforms like Staples and Dell, effectively masking the malicious content.
Timeline
October 2025 – October 2026: Cisco Talos tracked abuse across 25 platforms.
The Tech Race
This activity follows a pattern of third-party platform abuse seen in the 2023 MOVEit supply chain attack, where attackers leveraged trusted software infrastructure to gain unauthorized access. The campaign marks a departure from traditional phishing by exploiting the delivery mechanisms of trusted transactional systems.
Users should treat even authenticated order notifications with caution if they contain unexpected support instructions or external links. Companies using third-party notification services are encouraged to review audit logs for unauthorized message content injection.
The takeaway
The abuse of trusted transactional systems demonstrates that brand reputation can be weaponized against users. Monitor your inbox for unusual calls to action in legitimate order updates until vendors implement stricter validation for message content.
Further reading
For broader trends in digital defense, see our coverage of Cybersecurity.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you still trust order confirmation emails sent by major retailers to be secure?
