Today, we\u2019re warning of several online threats that could target you over the next few weeks and months: brand impersonation and fakes, credit card skimming, and malvertising. <\/p>\n
1. Brand impersonation scams<\/strong> <\/h2>\nThis Black Friday and beyond, you\u2019re likely to see scammers ripping off big name brands. Here are a few fakes you should look out for. <\/p>\n
Temu ads offer discounted PS5s<\/strong> <\/h3>\nScrolling through Facebook, we were presented with a couple of posts advertising discounted PS5s. <\/p>\n![\"Ads](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/Temu-ads.png?w=1024\")
<\/figure>\n\n\u201cQuit overspending on PS5! This one I got off TEMU is AWESOME and is much cheaper. I\u2019d highly recommend picking this up!\u201d <\/p>\n<\/blockquote>\n
Of course, it\u2019s tempting to get a discount on high-value items like a PlayStation 5, but Temu doesn\u2019t actually sell PS5s.<\/p>\n
If you click the play button on the \u201cvideo,\u201d you are instead redirected to a Temu page selling various PlayStation accessories that are not official or in any way approved by Sony.\u00a0\u00a0<\/p>\n
Fake Amazon offers you great deals this Black Friday<\/strong> <\/h3>\nAmazon is relatively low cost, it\u2019s convenient, and you can look at someone\u2019s wish list on there. Except in this scam we caught online, the website isn\u2019t really Amazon\u2014check out the URL. <\/p>\n![\"Screenshot](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/Amazon-watermark.png?w=932\")
<\/figure>\nFake online stores like this use Amazon\u2019s branding to sell counterfeit products. Even if you take the risk and buy a knock off product (which we think is a bad idea), you have no guarantee of receiving the merchandise, and definitely no buyer protection. <\/p>\n
Walmart makes it easy for you to buy gift cards<\/strong> <\/h3>\nNothing says \u201cI saw this and thought of you\u201d like a Walmart gift card on Christmas day. But make sure you are buying from the right website. <\/p>\n
Again, in this example, check out the URL\u2014this website might look Walmart, but it\u2019s a fake that will happily take your money in exchange for nothing.\u00a0<\/p>\n![\"Screenshot](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/Walmart-watermark.png?w=928\")
<\/figure>\n\u201cUSPS\u201d now delivers you fraud<\/strong> <\/h3>\nIf you\u2019re taking advantage of Black Friday sales and buying many things at once, it can be tricky to keep track of what you\u2019ve ordered. Even if you do know what’s coming, you often don\u2019t know which package service will deliver it to your door. Scammers take advantage of this and will send fake delivery notice emails that encourage you to click on them.\u00a0<\/p>\n
With this fake USPS site, you are asked to pay a small fee to have your delivery processed. However, once you hand over your card details the scammers can take whatever amount they like and sell your details to other criminals. <\/p>\n![\"Screenshot](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/USPS-watermark.png?w=1024\")
<\/figure>\nThese scams are very common. In fact, when we looked, we saw 50 fake USPS sites set up in only a day: <\/p>\n![\"Diagram](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/USPS-sites-watermark.png?w=1024\")
<\/figure>\n2. Credit card skimmers<\/strong> <\/h2>\nWe\u2019re seeing a lot of online stores hosting credit card skimmers,<\/a> especially smaller retailers. <\/p>\nA credit card skimmer is a piece of malware that is injected into a website, often through vulnerabilities in the content management system (CMS) or the plugins that the site owner uses. <\/p>\n
When visiting a site that has a card skimmer on it, you\u2019ll likely have no idea it\u2019s even there. However, a single script injection is enough to steal your credit card data. <\/p>\n![\"Screenshot](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/code-watermark.png?w=1024\")
<\/figure>\nLast year, we saw a large uptick in card skimmers<\/a> just before the holiday season. One particular campaign that we tracked peaked in April 2023, but then really slowed down during the summer months. Across months, cybercriminals had infected multiple websites and built custom templates to trick victims into handing over their credit card details. By October, the same campaign had increased to its highest volume yet, and it is highly likely that this year will be the same.\u00a0<\/p>\nWhen looking at compromised websites, it can be hard to tell what\u2014if anything\u2014is wrong. However, if a site looks like it hasn\u2019t been maintained in a while (for example, it displays outdated information, such as \u2018Copyright 2022\u2032) you should avoid entering in your card details. Most compromises happen because a website\u2019s CMS and its plugins are outdated and vulnerable.\u00a0<\/p>\n
Our free browser extension Malwarebytes Browser Guard<\/a> blocks credit card skimmers by default. If you visit a compromised store you\u2019ll be shown a warning like this:\u00a0<\/p>\n![\"\"](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/image_e05f85.png\")
<\/figure>\nAccess to the store isn\u2019t blocked, we just block the skimmer code so it can\u2019t load. And while you could in theory still shop safely, we\u2019d still advise you to avoid buying anything from there. <\/p>\n
3. Malvertising increases in line with gift shopping<\/strong> <\/h2>\nMalvertising\u2014or malicious advertising\u2014is a favorite of scammers, who use online ads and sponsored search results to deliver malware to their unsuspecting victims. <\/p>\n
Malvertising doesn\u2019t require that criminals know a victim\u2019s email address, login credentials, or personal information to deliver them malware. All the scammers need to do is fool someone into clicking on an ad<\/a> that looks legitimate. <\/p>\nLast fall, Malwarebytes tracked a 42% increase month-over-month in malvertising incidents in the US. This year we\u2019re seeing a similar uptick, with a 41% increase from July to September as we head into the holiday shopping season. <\/p>\n
In terms of the actual advertiser accounts that are used in malvertising campaigns, most are based in the US and are set up using a combination of fake identities or hijacked accounts. However, according to our research findings, ads originating in Pakistan and Vietnam account for 90% of the fraud. <\/p>\n![\"Pie](\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2024\/11\/Advertiser-origin-watermark.png?w=604\")
<\/figure>\nMost (77%) of the accounts are used once only\u2014created quickly and then burned. Once that account is dead, cybercriminals spin up the next one and on it goes. <\/p>\n
No brand is safe from malvertisers. We\u2019ve tracked campaigns that spoof Google<\/a>, Amazon<\/a>, eBay,<\/a> Walmart<\/a>, Lowe\u2019s<\/a>\u2014and even Malwarebytes<\/a>. <\/p>\nOur advice: It\u2019s not always easy to tell a real ad from a scam, so it\u2019s best to avoid clicking on sponsored ads at all. Use genuine search results or navigate directly to the site yourself. <\/p>\n
How to shop safely this holiday season <\/strong> <\/h2>\n\n- Remember: If it\u2019s too good to be true then it probably is.<\/strong> Discounted items are tempting\u2014especially at a time of year when lots of spending takes place\u2014but these offers often amount to nothing. Instead, research the best deal at reputable retailers.\u00a0<\/li>\n<\/ul>\n
\n- Don\u2019t get rushed into making decisions.<\/strong> Scammers will use a sense of urgency to pressure you into performing quick actions before you can properly think things through. Take your time before doing anything like clicking links or entering card details. <\/li>\n<\/ul>\n
\n- Get an ad and malicious content blocker like <\/strong>Malwarebytes Browser Guard.<\/strong><\/a> <\/strong>If you\u2019re blocking ads then you can\u2019t be tricked into clicking on them. Browser Guard (which is free!) also protects against credit card skimming and other online threats. <\/li>\n<\/ul>\n
\n- Keep an eye on your financial statements: <\/strong>An uptick in online shopping deserves an uptick in vigilance with checking online bank accounts, credit card statements, investment portfolios\u2014in fact, any financial account data. Flag anything that seems suspicious with your provider. <\/li>\n<\/ul>\n
\n- Protect your online accounts. <\/strong>Use a different password for every account (a password manager is super helpful in generating and storing all your passwords), and set up multi-factor authentication (MFA) wherever you can. <\/li>\n<\/ul>\n
\n- Protect your devices:<\/strong> Most security products offer some kind of web protection that detects malicious domains and IP addresses, including Malwarebytes Premium<\/a> which offers web and phishing protection. <\/li>\n<\/ul>\n
\n- Clean up your personal data online: <\/strong>Cybercriminals use publicly available information in their scams, so check what information is available about you online using our free Digital Footprint scan.<\/a> You can also take the first step in removing your personal information from the network of data brokers online with our Personal Data Remover<\/a>.\u00a0<\/li>\n<\/ul>\n
Scrolling through Facebook, we were presented with a couple of posts advertising discounted PS5s. <\/p>\n \u201cQuit overspending on PS5! This one I got off TEMU is AWESOME and is much cheaper. I\u2019d highly recommend picking this up!\u201d <\/p>\n<\/blockquote>\n Of course, it\u2019s tempting to get a discount on high-value items like a PlayStation 5, but Temu doesn\u2019t actually sell PS5s.<\/p>\n If you click the play button on the \u201cvideo,\u201d you are instead redirected to a Temu page selling various PlayStation accessories that are not official or in any way approved by Sony.\u00a0\u00a0<\/p>\n Amazon is relatively low cost, it\u2019s convenient, and you can look at someone\u2019s wish list on there. Except in this scam we caught online, the website isn\u2019t really Amazon\u2014check out the URL. <\/p>\n Fake online stores like this use Amazon\u2019s branding to sell counterfeit products. Even if you take the risk and buy a knock off product (which we think is a bad idea), you have no guarantee of receiving the merchandise, and definitely no buyer protection. <\/p>\n Nothing says \u201cI saw this and thought of you\u201d like a Walmart gift card on Christmas day. But make sure you are buying from the right website. <\/p>\n Again, in this example, check out the URL\u2014this website might look Walmart, but it\u2019s a fake that will happily take your money in exchange for nothing.\u00a0<\/p>\n If you\u2019re taking advantage of Black Friday sales and buying many things at once, it can be tricky to keep track of what you\u2019ve ordered. Even if you do know what’s coming, you often don\u2019t know which package service will deliver it to your door. Scammers take advantage of this and will send fake delivery notice emails that encourage you to click on them.\u00a0<\/p>\n With this fake USPS site, you are asked to pay a small fee to have your delivery processed. However, once you hand over your card details the scammers can take whatever amount they like and sell your details to other criminals. <\/p>\n These scams are very common. In fact, when we looked, we saw 50 fake USPS sites set up in only a day: <\/p>\n We\u2019re seeing a lot of online stores hosting credit card skimmers,<\/a> especially smaller retailers. <\/p>\n A credit card skimmer is a piece of malware that is injected into a website, often through vulnerabilities in the content management system (CMS) or the plugins that the site owner uses. <\/p>\n When visiting a site that has a card skimmer on it, you\u2019ll likely have no idea it\u2019s even there. However, a single script injection is enough to steal your credit card data. <\/p>\n Last year, we saw a large uptick in card skimmers<\/a> just before the holiday season. One particular campaign that we tracked peaked in April 2023, but then really slowed down during the summer months. Across months, cybercriminals had infected multiple websites and built custom templates to trick victims into handing over their credit card details. By October, the same campaign had increased to its highest volume yet, and it is highly likely that this year will be the same.\u00a0<\/p>\n When looking at compromised websites, it can be hard to tell what\u2014if anything\u2014is wrong. However, if a site looks like it hasn\u2019t been maintained in a while (for example, it displays outdated information, such as \u2018Copyright 2022\u2032) you should avoid entering in your card details. Most compromises happen because a website\u2019s CMS and its plugins are outdated and vulnerable.\u00a0<\/p>\n Our free browser extension Malwarebytes Browser Guard<\/a> blocks credit card skimmers by default. If you visit a compromised store you\u2019ll be shown a warning like this:\u00a0<\/p>\n Access to the store isn\u2019t blocked, we just block the skimmer code so it can\u2019t load. And while you could in theory still shop safely, we\u2019d still advise you to avoid buying anything from there. <\/p>\n Malvertising\u2014or malicious advertising\u2014is a favorite of scammers, who use online ads and sponsored search results to deliver malware to their unsuspecting victims. <\/p>\n Malvertising doesn\u2019t require that criminals know a victim\u2019s email address, login credentials, or personal information to deliver them malware. All the scammers need to do is fool someone into clicking on an ad<\/a> that looks legitimate. <\/p>\n Last fall, Malwarebytes tracked a 42% increase month-over-month in malvertising incidents in the US. This year we\u2019re seeing a similar uptick, with a 41% increase from July to September as we head into the holiday shopping season. <\/p>\n In terms of the actual advertiser accounts that are used in malvertising campaigns, most are based in the US and are set up using a combination of fake identities or hijacked accounts. However, according to our research findings, ads originating in Pakistan and Vietnam account for 90% of the fraud. <\/p>\n Most (77%) of the accounts are used once only\u2014created quickly and then burned. Once that account is dead, cybercriminals spin up the next one and on it goes. <\/p>\n No brand is safe from malvertisers. We\u2019ve tracked campaigns that spoof Google<\/a>, Amazon<\/a>, eBay,<\/a> Walmart<\/a>, Lowe\u2019s<\/a>\u2014and even Malwarebytes<\/a>. <\/p>\n Our advice: It\u2019s not always easy to tell a real ad from a scam, so it\u2019s best to avoid clicking on sponsored ads at all. Use genuine search results or navigate directly to the site yourself. <\/p>\n<\/figure>\n\n
Fake Amazon offers you great deals this Black Friday<\/strong> <\/h3>\n
<\/figure>\nWalmart makes it easy for you to buy gift cards<\/strong> <\/h3>\n
<\/figure>\n\u201cUSPS\u201d now delivers you fraud<\/strong> <\/h3>\n
<\/figure>\n<\/figure>\n2. Credit card skimmers<\/strong> <\/h2>\n
<\/figure>\n<\/figure>\n3. Malvertising increases in line with gift shopping<\/strong> <\/h2>\n
<\/figure>\nHow to shop safely this holiday season <\/strong> <\/h2>\n
\n
\n
\n
\n
\n
\n
\n