Cisco Talos Uncovers 1,400 Scam Emails Sent Through Staples and Dell Order Notification Systems

Cisco Talos identified roughly 1,400 scam emails delivered through legitimate Staples and Dell order notification systems, exposing how attackers can insert fraudulent support instructions into authenticated transactional messages.

The findings fit a wider pattern: Talos observed abuse across more than 25 legitimate platforms over the past year, including collaboration, productivity, payments, file sharing, surveys, and artificial intelligence services.

Across these environments, attacker-controlled input becomes content inside notifications that inherit the provider’s reputation.

The Staples campaign used order confirmations appearing from support@orders.staples.com.

One message described an Apple iPad purchase and included convincing order details, delivery information, pricing, and standard retailer branding.

However, fields intended for shipping or billing information contained “Helpline 806 283 7712” and “Order Confirmed.”

Instead of directing recipients to a phishing website, the message encouraged them to telephone an attacker-controlled number about an unexpected purchase.

That transition creates an opportunity for subsequent social engineering, including payment manipulation, credential theft, or remote assistance fraud; the supplied findings do not establish which outcomes occurred.

Cisco Talos observed that, the campaigns exploit trusted commerce workflows rather than relying on forged sender identities or lookalike domains.

Staples and Dell Systems Abused

The Dell example presented an order for Microsoft Project Standard 2024 totaling $736.09.

By inputting a “hostile string” such as a cryptocurrency-themed lure into fields intended for a name, company, or title, the attacker forces the platform to treat this data as legitimate user information. 

Its “Ship To” and “Bill To” sections contained “Confirmed Order,” “Helpline 808 232 6397,” and “Call Our Sales Team,” turning ordinary transaction fields into fraudulent support prompts.

Talos reported passing DKIM and DMARC results for the samples, including alignment associated with orders.staples.com and order.dell.com.

Forwarding through additional mail infrastructure complicated message provenance, but the central weakness remained unchanged: authentication validated aspects of delivery, not the legitimacy of embedded telephone numbers or transaction claims.

The campaigns extend the platform-as-a-proxy model described in Talos’ earlier research on weaponizing SaaS notification pipelines.

That investigation documented attackers embedding lures in GitHub commit messages and Jira project or invitation fields, causing legitimate services to distribute malicious instructions through their own email infrastructure.

In the GitHub activity, Talos found invoice-themed lures in 1.20% of observed noreply@github.com traffic across five days.

The proportion reached approximately 2.89% of its daily sample on February 17, 2026. Those measurements concern the earlier GitHub investigation, not the Staples and Dell campaigns access.

The newer findings also describe registration abuse and malicious delivery reports. Attackers can place hostile strings in registration fields that automated welcome messages reproduce.

In selected list-bombing cases, this turns an inbox-flooding technique into a mechanism for delivering attacker-controlled content.

Delivery status notifications introduce another route: returned message bodies or nested MIME objects can preserve phishing material inside legitimate administrative wrappers.

Talos observed a WeTransfer-themed lure carried in such a notification, although the supplied account outlines multiple possible delivery mechanisms rather than establishing one definitive origin.

Defenders should inspect rendered transactional content alongside sender identity.

Retailers should validate reflected fields, flag misplaced telephone numbers and support instructions, and correlate notifications with account history, payment status, shipping context, and authorized support channels.

Email gateways should recursively inspect returned messages and nested MIME content instead of exempting delivery reports.

For recipients, unexpected purchase claims warrant verification through independently accessed retailer accounts or established support channels, not telephone numbers supplied inside suspicious transaction fields.

The decisive distinction is between trusted delivery infrastructure and trustworthy message content. Neither should be treated as proof of the other.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.