Threat actors are abusing virtual shopping lists to trick Walmart customers into transferring money or disclosing personal information, according to researchers at Malwarebytes. Links to the lists are distributed via Google Ads that impersonate Walmart support.
As a result, someone who searches for Walmart’s customer service will see the ad at the top of the search results. If the user clicks the ad, they’ll be redirected to a Walmart List containing a scammer’s phone number.
Walmart Lists is a feature on Walmart’s website and app that allows users to write their own shopping lists, which can be shared with other people. However, instead of “eggs” or “milk,” the scammers have written “Walmart Customer Support” alongside a phone number.
If a user calls this number, they’ll be connected with a scammer who informs them that a warrant is out for their arrest due to a recent transaction from their bank account that was sent to a narco-trafficking group. The scammer, impersonating a bank employee or law enforcement investigator, attempts to trick the victim into transferring the rest of their money into a Bitcoin account in order to prevent additional transactions.
Malwarebytes offers the following recommendations to help users avoid falling for social engineering attacks:
- Sponsored results, or ads, can be dangerous due to ongoing and relentless malvertising campaigns. Learn to spot a regular search result from an ad, and if possible avoid clicking on ads.
- Even if you are on an official website, the content you see may not be legitimate. This is a particularly hard one because people will naturally trust that the brand’s own site will be safe. But scammers and spammers can inject content in comments, or custom pages.
- Scare tactics and pressure to act quickly are almost always malicious. Unfortunately, most brands also have these promotions that expire soon and customers believe they need to buy the product now or lose out on a deal. Having said that, your local store will never threaten you on the phone with an arrest warrant.
- Scammers will often tell their victims to keep everything confidential and not discuss it with other family members or bank clerks. This is only in the scammers’ interest to not be exposed; by all means you should ask for clarification and seek help from others.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Malwarebytes has the story.
Here's how it works:
