Malicious Retail Phishing Sites Spike Ahead of Shopping Holidays

Researchers at Check Point have observed a record number of malicious phishing shopping websites that have been set up over the past two months. The researchers assume these sites were registered in anticipation of Black Friday and Cyber Monday in the US, Single’s Day in China, and Click Frenzy in Australia.

“Since the beginning of October 2021, CPR researchers witnessed the highest amount of malicious websites related to shopping and sales offers,” Check Point says. “On average, over 5300 different websites per week were spotted, marking a 178% increase, compared to the average in 2021, thus far.”

Check Point offers the following advice to help people avoid falling for these attacks:

• “Always shop from an authentic, reliable source. Do not click on promotional links you get over email or social media. Proactively Google search your desired retail or brand.
• “Be attentive for lookalike domains. You should notice spelling accuracy in emails or websites, and note unfamiliar email senders or peculiar email addresses you receive promotions from.
• “Too good to happen shopping offers are indeed too good to happen. A new iPad will NOT go on an 80% discount this season, unfortunately.”

The researchers add that people should always be suspicious of unexpected password reset emails.

“Always be attentive to password reset emails, especially when volumes of traffic online are at a peak, like the November shopping season,” Check Point says. “If you receive an uninvited password reset email, always visit the website directly (don’t click on embedded links) and change your password to something different on that site. Not knowing your password is, of course, the problem that cybercriminals face when trying to gain access to your online accounts. By sending a fake password reset email that directs you to a lookalike phishing site, they can convince you to type in your account credentials and send those to them.”

New-school security awareness training can enable your employees to thwart social engineering attacks.

Check Point has the full story.