"Thank God, may God bring prosperity to our Islamic State men," read one tweet in Arabic on an account that regularly favours the radical Islamist movement.
"The Islamic state is expanding in Europe," read an Arabic-language tweet on another account also known to support ISIS.
The attack was the third major act of violence against civilian targets in Western Europe in eight days. Previous attacks in France and Germany were claimed by ISIS and Munich police said they suspected the latest assault was a terrorist attack.
Authorities were evacuating people from the Olympia mall in the Bavarian capital but many others were hiding inside.
A Munich police spokeswoman said multiple people were killed or wounded. "We believe we are dealing with a shooting rampage," the spokeswoman said.
Bavarian broadcaster BR said six people were dead and many wounded in the shopping mall. NTV television reported the state's interior ministry as saying three people were dead, but the ministry said later it would not confirm this.
It was not immediately clear who carried out the attack, which took place a week after an axe-wielding teenager went on a rampage on a German train, wounding four people before he was shot dead.
ISIS claimed responsibility for that attack.