Scams & Phishing News Fraud network uses 4,700 fake shopping sites to steal credit cards

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/fraud-network-uses-4-700-fake-shopping-sites-to-steal-credit-cards/

A financially motivated Chinese threat actor dubbed "SilkSpecter" is using thousands of fake online stores to steal the payment card details of online shoppers in the U.S. and Europe.

The fraud campaign started in October 2024, offering steep discounts for the upcoming Black Friday shopping period that usually sees elevated shopping activity.

EclecticIQ threat researcher Arda Buyukkaya, who discovered the campaign, told BleepingComputer that, as of the publishing of their report, SilkSpecter operates 4,695 fraudulent domains.

These sites impersonate well-known brands such as the North Face, Lidl, Bath & Body Works, L.L. Bean, Wayfair, Makita, IKEA, and Gardena.

In many cases, the domain names used in the campaign include the 'Black Friday' string, clearly targeting online shoppers looking for discount deals.

BlackFriday shoppers are recommended only to visit official brand websites and avoid clicking on ads, links from social media posts, or promoted results on Google Search.

Finally, cardholders should activate all available protection measures on their financial accounts, including multi-factor authentication, and monitor their statements regularly.

Fraud network uses 4,700 fake shopping sites to steal credit cards

A financially motivated Chinese threat actor dubbed "SilkSpecter" is using thousands of fake online stores to steal the payment card details of online shoppers in the U.S. and Europe.

www.bleepingcomputer.com

 

[Sorrento]

Good advice & one of the reasons I have many bookmarks to the correct site (assuming the genuine site was bookmarked) though many will be gullible and clicking on SM without a moments thought. There are some big names in the list & with Black Friday no doubt many will sadly be conned.

 

[TairikuOkami]

However, their sites usually use top-level domains like '.shop,' '.store,' '.vip,' and '.top,' which are not generally associated with large brands or trustworthy e-commerce sites.

I have all those domains blocked via NextDNS. For the record, Controlid considers it unnecessary, since according to them, blocking TLDs adds no security.

 

[Jonny Quest]

Avira seemed to pick up on it too, as well as my router when I disabled Avira Web protection.

 

[Sorrento]

ESET are on the ball also

 

[Thales]

I recommend "HaGeZi's The World's Most Abused TLDs"

 

[rashmi]

When I try to go to northfaceblackfriday.shop, Edge takes me to the legitimate amazon.com.

 

[Allego]

When I try to go to northfaceblackfriday.shop, Edge takes me to the legitimate amazon.com.

Looks like "region-based" phishing. They redirect you to a legitimate site if your ip didn't match they target country. It may grab your ip address too.