Threat Landscape: Black Friday & Cyber Monday 2022

Product Serial: B-2022-11-11a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Threat Landscape for Black Friday & Cyber Monday 2022.

Standing Intelligence Requirements

PII

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on November 9, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Black Friday and Cyber Monday (BFCM) are two of the busiest shopping days on the retail calendar and a prime period for malicious actors to target consumers. Black Friday is the name given to the Friday after Thanksgiving in the United States and has traditionally marked the start of the holiday shopping season. It is one of the busiest days of the year for retailers and consumers, with extensively promoted sales and discounted prices both online and in-store. In 2022, Black Friday falls on November 25, though promotions and discounts begin up to a month in advance. Cyber Monday refers to the Monday following Black Friday and falls on November 28 this year. Sales forecasts indicate that BFCM 2022 is anticipated to be larger in sales than previous years despite strained economic and geopolitical circumstances.

Threat actors using BFCM to target retailers and consumers in recent years have had a variety of motivations, including financial gain, political persuasion, and activism. Attacks occur in both the physical and cyber domains. BFCM represents an opportunity for cyber threat actors to hide amongst the excitement about and rapid increase in retail activity, leveraging the urgency and enthusiasm generated by the holiday sales to defraud victims. Both retailers and consumers are attractive targets. Malicious cyber activity during recent BFCMs highlighted the efficacy of leveraging human error to scam customers. Retailers face a host of potential business threats, including impersonations, distributed denial of service attacks (DDoS), and e-commerce skimming malware.

Key Findings

Sales forecasts indicate that Black Friday and Cyber Monday 2022 are anticipated to be larger in sales than in previous years.
ZeroFox Intelligence assesses that social engineering will almost certainly remain one of the most prolific ways financially-motivated threat actors target shoppers.
We expect an increase in SMS-based phishing scams and callback phishing throughout the Black Friday and Cyber Monday 2022 timeframe.
We anticipate malicious actors will leverage fraudulent domains during BFCM 2022 to: dupe unsuspecting victims into purchasing fake items, harvest financial information, or deploy malware.
Threat actors will most likely advertise fake or misleading discounts or prizes in social media posts that contain links to malicious websites.
Consumers should be particularly wary of being contacted about BFCM 2022 sales via unsolicited direct messages.
ZeroFox Intelligence has not identified threat actors or groups planning to target retail locations on Black Friday.
Recent acts of vandalism against retail locations - carried out by activists - highlight a tactic to consider for proactive prevention of would-be Black Friday demonstrations.