Threat actors are actively abusing [Shopify's Shop app](https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/) — the order-tracking companion