Alpha Team Research: Black Friday Scams, Malware and Phishing, Oh My

Alpha Team Research: Black Friday Scams, Malware and Phishing, Oh My!

With Thanksgiving rapidly approaching, the holiday shopping season has begun to ramp up for consumers worldwide. Just like consumers, however, scammers are also prepping for holiday activities. In preparation for this annual barrage of holiday scams, Alpha Team has deployed the ZeroFOX platform to collect hundreds of thousands of posts, pages, domains, certificate transparency logs, websites and chatter related to Black Friday. Our goal in doing this warroom activity was to uncover how cybercriminals use holidays such as Black Friday in order to defraud, scam or attack internet users.

Recommendations

• Verify the URL of any site you may purchases from. Phishing and counterfeit goods sites often imitate the websites of legitimate brands in order to appear more credible
• Use caution when interacting with promotional sites, especially when asked to provide sensitive personal information. If a promotion sounds too good to be true, it probably is. Consider using a separate email for promotional entries

Details

Holiday Scammers on Social Target Brick and Mortar Stores in Droves

Between November 1 and November 20, 2019, ZeroFOX identified 61305 potential scams across 26 brands selected for this report. When broken out among these brands, we observed that the vast majority of these scams targeted customers of brick and mortar retail stores. Smaller percentages targeted electronics brands and online marketplaces. Only small fractions of a percent targeted luxury brands and jewelry brands.

Figure 1. Pie chart showing distribution of scams by vertical targeted

Scammers likely target brick and mortar retailers in such high quantities, because these kinds of scams will be attractive to a larger pool of consumers and thereby potential victims. Fewer consumers are in the market for luxury goods and high end jewelry than are shopping at large brick and mortar stores that appeal to multiple price points. Brick and mortar stores also carry a wide range of goods, from electronics to jewelry, versus stores that only sell one kind of good.

These kinds of scams generally offer victims "something for nothing," in the form of a giveaway, giftcards, or some kind of discount or coupon. Users are urged to input personal information, usually at minimum their email and physical address, to be entered to win a giveaway or giftcard, or to receive a coupon. Although these scams operate year-round, they also capitalize on gift-givers during the holiday season, exploiting the season to instill a sense of urgency in prospective victims. Of the retail scams we analyzed during this work:

• 11741 contained language related to gift-giving
• 4593 contained the word “holiday”
• 637 were specifically related to Black Friday or Cyber Monday
• 353 mentioned "Christmas" or "Thanksgiving"

Additionally, 554 scams took advantage of charitability, and included the word "donate."

In order to increase visibility, scammers often leverage hashtags in their posts, like #blackfriday, #cybermonday, and #giveaway. This makes these posts more likely to be shown to social media users, based on the social platform's algorithms, and also makes them searchable. Similarly, scammers may leverage fake accounts to like and share or retweet these scam posts, giving them more legitimacy.

Figure 2. Twitter giftcard scam, linking to malicious "giveaway" site

Above is one such example of a giftcard scam. Clicking the link in this post takes users to a poorly designed landing page, where several giveaways are advertised. Clicking through to one of these givaways redirects users to a phishing page, which requests a selection of personal information.

Figure 3. Samsung Galaxy S10 giveaway phishing page

Online Shopping and Electronics Lead The Pack in Suspicious Domains

If brick and mortar dominate scams on social and digital platforms, online shopping and electronics dominate suspicious domains. ZeroFOX Alpha Team found 124,000 domains that contain the brand name out of the list of 26 selected for this report. The team filtered the 124,000 domains by Certificate Issuer for legitimate domains and found that Apple, Amazon and Target are the top impersonated domains within the bunch:

Figure 4. Pie Chart for Abused Brands filtered by Issuer in Certificate Transparency Log

Many of these domains contain keywords that indicate it could be used for phishing or abuse. This is generally combined with a call to action, especially with phishing attacks, to trick the user that they must login or verify their account to continue.

Figure 5. Pie Chart for Top Suspicious Words

Since these domains were retrieved from the certificate transparency log, the probability of them serving content is higher than a registered or parked domain, due to generating a TLS certificate is an additional step when setting up attack infrastructure. Alpha Team performed a hunt on small sample the associated list and found phishing websites, giveaway scams, coupon scams and even some suspicious chrome extensions.

Figure 6. iPhone Giveaway Scam

Figure 7. Impersonating domain for Walmart, leading users to install a potentially unwanted/malicious Chrome extension

In the case of Figure 7, the Chrome extension had over 60,000 installs and dozens of negative reviews complaining about data theft, malware, and one person even saying they were extorted by the developer:

Figure 8. User reporting malicious behavior done by extension and the developer themselves.

Conclusion

Cybercriminals are opportunistic, and capitalize on anything they can in order to improve their odds of profiting off a scam. Social media scams, as well as malicious domains, are two attack vectors ZeroFOX has observed spiking in use as the holiday season approaches. To best protect yourself against these kinds of scams, ZeroFOX recommends exercising a level of caution whenever you consider giving away valuable personal information for promotions or giveaways. Legitimate giveaways rarely ask for anything more than an email address. A promotion requesting anything further is likely a scam. Additionally, as you make online purchases this holiday season, be sure to verify that the domain you are making a purchase from, is the one you intend to interact with. Attackers often mimic reputable brands to peddle their own scams and phishing sites.

Methodology

The Alpha Team seeded a ZeroFOX platform deployment with top retail brands, from a variety of different verticals, in order to uncover chatter and malicious traffic that could be related to Black Friday. Within 1 week, the platform analyzed 600,000 posts, pages, accounts and blogs, and 90,000 of those pieces of content where suspicious and alerted in our platform. The team also reviewed 1 months worth of Certificate Transparency log data (approximately 22,000,000 logs) in order to study how scam infrastructure is being deployed and abused by fraudsters in order to target victims.