As we move into the holiday season, the online shopping landscape becomes a bustling hub of activity.

However, there’s a lurking danger behind every sickly scented candle on offer – cybercrimes targeting unsuspecting victims.

In a recent blog, Check Point Research (CPR) delved into cyber-criminal tactics, where luxury brands are exploited as bait to lead users into clicking on malicious links.

A Click That Might Cost More Than you Realise

As the November shopping frenzy approaches, Check Point Research has unearthed a concerning email pattern employed by hackers. This deceptive tactic involves the spoofing of renowned brands, such as Louis Vuitton, Rolex, and Ray-Ban. The hackers craft enticing emails promising steep discounts on these luxury products, with the email addresses cleverly manipulated to mimic the authenticity of the brands.

Despite the appearance of legitimacy, a closer look reveals that the email origins have no connection to the actual luxury companies.

Upon clicking the tempting links within these emails, unsuspecting victims are led to websites meticulously designed to replicate the official sites of the targeted brands. These fraudulent sites then peddle luxury goods at unbelievably discounted prices, creating an alluring trap for potential shoppers.

However, the real danger lies in the malicious intent behind these sites, as they prompt users to input their account details. This sensitive information becomes vulnerable to theft by the attackers, highlighting the urgent need for heightened awareness and caution as we navigate the enticing realm of November shopping.

Delivery and Shipping Sectors

Cyber-criminals are using the delivery and shipping sectors during this traditional shopping period.

In October 2023, their findings revealed a staggering 13% increase in the number of malicious files associated with orders and delivery/shipping compared to October 2022. The escalating threat in these sectors underscores the evolving tactics of cyber adversaries, urging heightened vigilance and proactive cybersecurity measures.

As mentioned in CPR’s October 2023’s most wanted malware blog, the company found a campaign of AgentTesla with Archive files delivered as attachments to emails using subjects related to orders and shipments, such as – po-######.gz / shipping documents.gz, luring the victim to download the malicious file.

Phishing Websites

CPR also found examples of phishing websites, which have similar registered information and look similar to each other – offering well-known shoe brands at ridiculous prices.

www[.]reebokblackfridayoffers[.]com

www[.]oncloudblackfridaysale[.]com

www[.]hokablackfridaysale[.]com

www[.]salomonblackfridaysales[.]com

Cyber-criminals have invested significant effort in crafting deceptive websites that closely mimic authentic platforms, with major companies like the above examples being frequent targets of such spoofing.

Recommended reading

• Glasgow Uni Spin-out Lands £36m to ‘Digitise Chemistry’
• Scots Sensor Firm Neuranics Lands £1.9M Investment Led by Par Equity
• New Project to Improve the Next Generation of Prosthetic Limbs

This strategy aims to trick end-users into willingly providing their credentials. URL phishing serves as a pretext for executing credential harvesting attacks, and when executed effectively, it can result in the theft of usernames, passwords, credit card details, and other sensitive personal information. Particularly, successful instances often prompt users to log in to their email or bank accounts.

How To Identify URL Phishing

URL phishing attacks use trickery to convince the target that they are legitimate. Some of the ways to detect a URL phishing attack is to:

• Ignore Display Names: Phishing emails can be configured to show anything in the display name. Instead of looking at the display name, check the sender’s email address to verify that it comes from a trusted source.
• Verify the Domain: Phishers will commonly use domains with minor misspellings or that seem plausible. For example, company.com may be replaced with cormpany.com or an email may be from company-service.com. Look for these misspellings, they are a good indicator.
• Check the Links: URL phishing attacks are designed to trick recipients into clicking on a malicious link. Hover over the links within an email and see if they actually go where they claim. Enter suspicious links into a phishing verification tool like phishtank.com, which will tell you if they are known phishing links. If possible, don’t click on a link at all; visit the company’s site directly and navigate to the indicated page.