Attackers Abuse Legitimate Platforms to Deliver Scams

Researchers uncovered 1,400 fraudulent emails sent through official Staples and Dell notification systems.

Updated on Oct. 28, 2026 in Cybersecurity

Attackers Abuse Legitimate Platforms to Deliver Scams

Live Poll

Do you still trust order confirmation emails sent by major retailers to be secure?

Cisco Talos researchers have identified 1,400 scam emails that were successfully delivered through legitimate Staples and Dell order systems. The attackers exploited authenticated transactional messaging platforms to bypass standard security filters.

Why it matters

By inserting fraudulent support instructions into verified emails, attackers leverage the built-in trust users have for major retail brands. This technique makes it significantly harder for both consumers and automated email security filters to distinguish malicious content from legitimate communications.

Cisco Talos observed this abuse occurring across 25 different platforms over the past year. The campaign relied on injecting malicious support instructions directly into authenticated transactional message streams.

The players

Cisco Talos

This is a cybersecurity intelligence and research group that tracks global threat activity and identifies vulnerabilities in digital systems.

Staples

Staples is a multinational office supply company that manages extensive digital commerce and customer notification infrastructure.

Dell

Dell is a major technology corporation that operates global order management and customer support notification systems.

The details

The attackers inserted deceptive support instructions into messages that users typically trust to be legitimate. By utilizing the existing notification infrastructure of major companies like Staples and Dell, the scammers ensured their emails arrived with the high deliverability rates typically associated with verified brand communications.

The abuse of these platforms was observed by Cisco Talos between October 2025 and October 2026.

The Tech Race

This activity follows a pattern set by the 2020 SolarWinds supply chain attack by illustrating how threat actors compromise trusted infrastructure to carry out campaigns. It marks a shift where attackers no longer rely on spoofed domains, but rather manipulate internal enterprise systems to deceive users.

Users should treat even emails that appear to originate from verified retail accounts with caution if they contain unexpected support instructions. Verify any account or order issues directly through the official store website rather than clicking links or calling phone numbers provided in messages.

The takeaway

Scammers are increasingly hiding in plain sight by utilizing the very messaging systems that customers trust for order updates. Always verify support instructions by navigating to the official website independently rather than using contact information found in transactional emails.