Holiday shoppers in threat actors' sights
Thanksgiving, Black Friday, Cyber Monday, and Christmas bring millions of shoppers online with attractive discounts and limited time offers, but of course they also create ideal conditions for cybercriminals to exploit unwary bargain hunters.
A new report from Fortinet's FortiGuard Labs looks at the evolving threat surface of eCommerce, highlighting how cybercriminals are leveraging Remote Code Execution (RCE) exploits, Man-in-the-Middle (MITM) phishing kits, sniffers, and website cloning services to manipulate online transactions and gain access to steal sensitive data.
The report includes examples of cybercriminals using AI models like ChatGPT to craft convincing phishing emails, mimicking legitimate communications from retailers and banks. This increases the effectiveness of their scams, especially during peak shopping periods.
See also:
Identity issues cost retailers millions
McAfee reports rise in AI scams and deepfake threats for holiday shoppers
Shoppers willing to hand over personal data to get a holiday bargain
Popular platforms such as Adobe Commerce, Shopify, and WooCommerce are prime targets due to weak configurations and outdated plugins. Attackers are also deploying sniffers to capture customer data and using RCE exploits to gain admin access to shopping platforms.
During the holiday season, gift cards are choice targets for cybercriminals too. Stolen gift cards are often obtained through brute-force attacks on poorly secured accounts on e-commerce sites or by purchasing them using stolen credit cards. These gift cards are then circulated on darknet markets at cut-rate prices.
The report's authors note, "While the holiday season is a time of celebration and increased online activity, it also represents a period of heightened risk in the digital landscape. Cybercriminals leverage this transaction surge to deploy sophisticated attacks, ranging from phishing campaigns and stolen data sales to exploiting e-commerce platform vulnerabilities. This report's findings highlight the depth and breadth of these threats, illustrating the advanced tactics employed by threat actors on the dark web to target shoppers, businesses, and financial institutions."
You can read more on the Fortinet blog.
Image credit: nmedia/depositphotos.com