Cybercriminal activity increases ahead of the holiday season
Every year, the holiday season brings a predictable spike in online activity. However, in 2025, new reports suggest the volume of newly created malicious infrastructure, account compromise activity, and targeted exploitation of eCommerce systems is markedly higher.
Fortinet’s FortiGuard labs identified more than 18,000 holiday-themed domains registered in the past three months, including terms such as ‘Christmas,’ ‘Black Friday,’ and ‘Flash Sale.’ At least 750 of these were confirmed malicious. This indicates many domains are still considered non-malicious, posing a potential risk.
The research also finds a parallel surge among domains imitating major retail brands. Attackers registered over 19,000 eCommerce-themed domains, of which 2,900 were malicious.
At the same time a report from Darktrace finds a 54 percent month-on-month rise in phishing attacks impersonating well-known festive retailers like Walmart, Macy’s and Best Buy. Amazon is the most mimicked brand, making up 80 percent of phishing attacks in Darktrace’s analysis of global consumer brands.
See also:
Social media and marketplace scams surge ahead of the holiday season
One in 11 new Black Friday websites is malicious
Mobile threats increase ahead of holiday shopping season
Nivedita Murthy, senior staff consultant at application security specialist Black Duck says, “The online shopping experience has changed in recent years, and many users are now relying on the quick-click shopping experience on their mobile device. Users often also look out for the best deal, monitoring and tracking prices before they purchase, and Black Friday sales happen to be just the right time for many to make their move. With the number of users searching for sites that offer great deals they are also prime targets for scammers. Users are more likely to download an unknown app knowing they will get a good deal which makes mishing very common. App stores tend not to verify the authenticity or security of mobile applications due to the sheer volume of applications being hosted. There might be a base-level automated check, but malicious apps cannot be tested using automated scans. Smishing is not so popular as a lot of people are aware of the common text scams.”
You can find the latest research on the Fortinet and Darktrace sites.
Image credit: Jakub Jirsak/Dreamstime.com