Security researchers have observed a sharp increase in the number of phishing exploits in the run-up to Black Friday and Cyber Monday.
According to a new Check Point Software report, phishing emails have increased by over 13 times in the last six weeks. Currently, one in every 826 emails delivered is a phishing attempt, compared to less than one in 11,000 at the start of October.
Researchers at Check Point said ongoing COVID-19-related restrictions that limit shoppers’ access to physical stores is driving the spike in phishing attempts as hackers look to capitalize on the expected record numbers of people shopping online.
There were 80% more sale- or special-related email phishing campaigns in the first two weeks of November than the weekly average throughout October. These emails used terms like “special,” “offer,” “sale,” “cheap” and “% off.” And on November 9 and 10 alone, the number of “special offer” phishing campaigns exceeded the whole of the first week of October.
Researchers highlighted one email phishing campaign where threat actors imitated Pandora, the jewelry store. In this campaign, the sender’s email address was from an Amazon domain, but there was no mention of Amazon in the email or its links. Further investigation revealed it was a spoofed Amazon email address.
The State of Email Security 2020
Email security insights at your email perimeter, inside your organisation, and beyond
The links within the email initially led to the website www[.]wellpand[.]com, but a few days later, they led to www[.]wpdsale[.]com. These websites were registered at the end of October and beginning of November, right before the hackers sent the phishing emails -- a strong indication of a scam. Further investigation showed both websites were Pandora spoofs.
Check Point manager of data intelligence Omer Dembinsky said COVID-19 restrictions will inevitably drive more online shopping traffic, fueling hacking efforts.
“Consequently, we expect record-breaking hacker activity targeting online shoppers this upcoming holiday season, especially around Black Friday and Cyber Monday. We’re noticing an unusual and determined focus by hackers on ‘special offers’ this month of November,” he said.
“These phishing campaigns can be extraordinarily deceptive, and online shoppers could easily mistake them for real offers. We’re living in an age where every email in our inboxes must be treated with caution. I strongly urge every online shopper to think twice when looking at a “special offer” from their favorite brand.”
