Massive phishing campaign uses 6,000 sites to impersonate 100 brands

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/massive-phishing-campaign-uses-6-000-sites-to-impersonate-100-brands/

A widespread brand impersonation campaign targeting over a hundred popular apparel, footwear, and clothing brands has been underway since June 2022, tricking people into entering their account credentials and financial information on fake websites.

The brands impersonated by the phony sites include Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger, and others.

According to Bolster's threat research team, who discovered the campaign, it relies on at least 3,000 domains and roughly 6,000 sites, including inactive ones.

Bolster reports that the campaign had a significant activity spike between January and February 2023, adding 300 new fake sites monthly.

The domain names follow a pattern of using the brand name together with a city or country, followed by a generic TLD such as ".com."

The researchers say that the campaign operated over ten fake websites for Nike, Puma, and Clarks, featuring a design very similar to the official sites of the brands.

BleepingComputer navigated pages on some of these sites and found that they're not hastily built clones, as they feature realistic "About Us" pages, include contact details, the order pages work as expected, and are generally tricky to identify as suspicious.

The exact scam strategy followed in this campaign is unknown, but Bolster suggests that the sites either never ship the products customers pay for or ship Chinese knockoffs.

Additionally, any details entered on the checkout pages, most notably the credit card details, may be stored by the website operators and resold to cyber criminals.

When searching for the official website of a brand, skip all promoted results on Google Search. If still unsure, check the brand's Wikipedia page or social media channels for the legitimate URL.

Massive phishing campaign uses 6,000 sites to impersonate 100 brands

A widespread brand impersonation campaign targeting over a hundred popular apparel, footwear, and clothing brands has been underway since June 2022, tricking people into entering their account credentials and financial information on fake websites.

www.bleepingcomputer.com

 

[Jonny Quest]

When searching for the official website of a brand, skip all promoted results on Google Search. If still unsure, check the brand's Wikipedia page or social media channels for the legitimate URL.

If I wanted to confirm a link on Virus Total, would it be flagged if it wasn't legitimate, or would VT have to have a previous history of it being suspicious?
Would an AV anti-phishing filter catch this?

 

[upnorth]

If I wanted to confirm a link on Virus Total, would it be flagged if it wasn't legitimate, or would VT have to have a previous history of it being suspicious?
Would an AV anti-phishing filter catch this?

Not necessarily and extra because phishing urls in general have a very short time span. It still shouldn't be ignored as malicious re-directions can easy happen.

 

[HarborFront]

Luckily, I'm not buying any apparel, footwear, and clothing brands from websites. Usually, I'll buy from local shops instead

It's safer.

 

[Jonny Quest]

Luckily, I'm not buying any apparel, footwear, and clothing brands from websites. Usually, I'll buy from local shops instead

It's safer.

Same here, I need to try things on, otherwise, I'd be sending 1/2 the stuff back for not fitting right.