The Shop

Threat actors are exploiting Shop, an order-tracking app from Shopify, by inserting fake purchase receipts into users' order histories to deceive them into divulging sensitive information or installing remote access software.

A user reports receiving notifications from The Shop app about USPS packages being sent from their address to other states, which they did not authorize. They reported these instances to The Shop, but the app only removed the entries without further action, raising concerns about potential scams.