The 2020 Holidays are here and many global and domestic economies are preparing for the subsequent shopping. This buying season is being executed in an environment that has changed entirely due to the Corona Pandemic lockdowns and fears of virus infection. This creates – buying on-line. It is estimated that this will be the largest on-line/eCommerce holiday season ever. As tradition on Black Friday was once, consumers will not be standing outside of brick and mortar stores waiting for the latest deals in the same way they have in past seasons. They are going to use new web based services to find the best prices (and guaranteed and free delivery), check their reward point balances, and hopefully use loyalty programs to gain some discounts or other perks just for being a member, to increase their holiday spending budgets.[1]
Cybercriminals are already introducing new scams ahead of Black Friday and Cyber Monday. The number of online holiday shoppers this year is expected to climb sharply due to the pandemic and consequently, consumers can expect a blitz of scams, phishing attacks and other malicious activities. The risk of infection is driving consumers to shop from the safety of their homes, rather than venture out into stores. A recent study revealed that 62 percent of consumers shop more online now than before COVID-19. From a cybercriminal perspective, this skyrocketing level of online shoppers translates to more potential victims.
Hackers are looking to cash in on the top shopping days in the US Black Friday and Cyber Monday as well as other events, like Singles’ Day, which recently occurred in China. “Retailers have also been hit hard by the pandemic, and will likely send out even more emails showcasing their discounts and offers, which can be easily spoofed to trick consumers,” Egress CEO said in an email. “Recipients hunting for a good deal may find it difficult to differentiate between the swarm of legitimate emails, and phishing attacks trying to steal their data.”
During 2019, researchers said that social-media scams and domain-impersonation scams were some of the biggest types of attacks during the holiday shopping season. These scams were bent on either stealing credentials or payment data from unsuspecting shoppers or distributing malware onto their systems. This year, researchers say phishing attacks will continue to pose as a top threat during the holiday season. These types of attacks are increasingly getting more convincing and harder for recipients to spot. Attackers are using sophisticated tactics including visual CAPTCHAS[2] to target Office 365 users and token-based authorization methods.[3]
Authorities worldwide are already warning of a slew of scams leading up to the holiday season. Ahead of Singles’ Day, authorities in China warned of a “fake refund” phone scam where attackers impersonate a customer service officer from various brands to tell customers that a recent purchase is out of stock and promises a refund if they hand over their bank account details. According to the UK’s BBC, the scam recently cost one woman $30,000. The digital age is now and we are all targets for scammers on our social media accounts, cell phones, email, texts, message services and even landline telephones for those who have not yet joined the 21st Century. Cyber threat researchers have recently deleted fax machines from this list. (Ha!)
The US based Better Business Bureau (BBB), recently warned of scammers taking advantage of virtual holiday events, such as holiday markets and craft fairs, by creating phony copycat events that will charge for admission and steal victims’ credit-card information. “In another twist on this scam, some virtual holiday markets have a website or social media page where vendors can post photos of their products and links to their websites,” according to the BBB. “Be careful here too. Some consumers reported to BBB that they the clicked the links provided, thinking they lead to an online shop. Instead, these merchant sites downloaded malware.”
Consumers should always check email sender details carefully and hover over links before they click. “If you’re still not sure, you can always reach out to the retailer via their website, to check that the email you received is genuine. There are also lots of online resources to check out for more information, including many run by Government organizations,” warned a cyber security expert.
Once again, if an on-line offer or coupon seems too good to be true, please beware it most likely is not. Cyber actors are planning to fill your email account mail boxes and cell phones with offers that are only a “Click Away.” And your device will quickly be compromised. If a coupon or “Deal” is real, it will be posted on the merchant’s web site. Do not just click on a link made “conveniently available” on their email notification. Please take the extra few minutes to confirm an offer with the merchant’s or manufacturer’s real URL, not a typo squatted look-alike. The cyber thieves will also be promoting spoofed web sites that look, “just like the real web site,” to trick buyers into entering credit card information. Caveat Emptor, or “Buyer Beware” for the holiday and post-holiday buying seasons.
Red Sky Alliance has been has analyzing and documenting cyber threats and vulnerabilities for over 9 years and maintains a resource library of malware and cyber actor reports.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings: https://attendee.gotowebinar.com/register/8782169210544615949
- Reporting: https://www.redskyalliance.org/
- Website: https://www.wapacklabs.com/
- LinkedIn: https://www.linkedin.com/company/64265941
[1] https://threatpost.com/scams-black-friday-cybercriminal-craze/161239/
[2] a program or system intended to distinguish human from machine input, typically as a way of thwarting spam and automated extraction of data from websites.
[3] https://www.itpro.co.uk/security/357796/sharp-spike-in-phishing-attacks-in-the-weeks-ahead-of-black-friday
Comments