Massive phishing campaign uses 6,000 sites to impersonate 100 brands

Gandalf_The_Grey

Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,685
A widespread brand impersonation campaign targeting over a hundred popular apparel, footwear, and clothing brands has been underway since June 2022, tricking people into entering their account credentials and financial information on fake websites.

The brands impersonated by the phony sites include Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and others.

According to Bolster's threat research team, who discovered the campaign, it relies on at least 3,000 domains and roughly 6,000 sites, including inactive ones.

Bolster reports that the campaign had a significant activity spike between January and February 2023, adding 300 new fake sites monthly.

The domain names follow a pattern of using the brand name together with a city or country, followed by a generic TLD such as ".com."

The researchers say that the campaign operated over ten fake websites for Nike, Puma, and Clarks, featuring a design very similar to the official sites of the brands.
BleepingComputer navigated pages on some of these sites and found that they're not hastily built clones, as they feature realistic "About Us" pages, include contact details, the order pages work as expected, and are generally tricky to identify as suspicious.

The exact scam strategy followed in this campaign is unknown, but Bolster suggests that the sites either never ship the products customers pay for or ship Chinese knockoffs.

Additionally, any details entered on the checkout pages, most notably the credit card details, may be stored by the website operators and resold to cyber criminals.

When searching for the official website of a brand, skip all promoted results on Google Search. If still unsure, check the brand's Wikipedia page or social media channels for the legitimate URL.
 

Jonny Quest

Level 17
Verified
Top Poster
Well-known
Mar 2, 2023
799
When searching for the official website of a brand, skip all promoted results on Google Search. If still unsure, check the brand's Wikipedia page or social media channels for the legitimate URL.

If I wanted to confirm a link on Virus Total, would it be flagged if it wasn't legitimate, or would VT have to have a previous history of it being suspicious?
Would an AV anti-phishing filter catch this?
 

upnorth

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Jul 27, 2015
5,458
If I wanted to confirm a link on Virus Total, would it be flagged if it wasn't legitimate, or would VT have to have a previous history of it being suspicious?
Would an AV anti-phishing filter catch this?
Not necessarily and extra because phishing urls in general have a very short time span. It still shouldn't be ignored as malicious re-directions can easy happen.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top