Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers

The Phish, ‘n’ Ships fraud operation leverages, compromised websites to redirect users to fake online stores, which, optimized for search engine visibility, trick victims into providing credit card details to third-party payment processors, resulting in financial loss without receiving any products. 

Phishing attacks exploit consumer demand for hard-to-find items, redirecting victims to fake online stores.

Once on these fraudulent sites, users unknowingly provide payment card information, which cybercriminals then steal.

The 2014 crowdfunding success of a silicone “Power Mitt Oven Glove” inspired a niche market for retro-themed kitchenware, which persists. Similar products remain unavailable despite significant initial interest and positive user feedback.

It indicates a potentially fraudulent online listing for a product. The listing features watermarked images belonging to a different designer and online store, suggesting a deceptive attempt to sell a counterfeit or unauthorized version of the product with false promises of free shipping.

Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs

The user clicked through to a fake online store with a website URL different from the original search result. Despite this discrepancy, the site appears somewhat legitimate, with customer reviews further adding to this illusion. 

The website lacks data validation for the phone number field during checkout, allowing invalid input and potentially compromising data security, which raises concerns about the platform’s overall security practices.

Victimized by a phishing attack, the consumer experienced financial loss and potential identity theft after providing sensitive payment information to a fraudulent online store, leading to a chargeback request with their payment processor.

Phish ‘n’ Ships attacks involve infecting legitimate websites with fake product listings, redirecting search traffic to these malicious listings, and ultimately transitioning users to fake web stores for fraudulent transactions.

Threat actors exploited n-day vulnerabilities to infect websites with malicious scripts, which injected fake product listings and optimized their search engine ranking, leading to malicious file downloads when unsuspecting users click on these listings.

The injected script, likely triggered by a user clicking on a compromised link, redirects the user to a malicious website under the control of threat actors, which are dynamically generated by a C2 server to evade detection and disruption.

The threat actors redirect users to hundreds of fake web stores, identified by URL strings like “product.aspx?cname=<ID>” or “product_details/<ID>.html”. These stores, hosted on 14 IP addresses, serve as a key pivot point for further investigation. 

They manipulate the checkout process to redirect users to a fraudulent website under their control, which allows them to capture the user’s payment card information through a payment processor gateway, ultimately leading to financial loss for the victim.

By leveraging a sophisticated toolset, they facilitate their malicious operations, which include tools for monitoring product trends, capturing product images, and diversifying payment methods, including direct payment card skimming.

According to HUMAN, recent collaborative efforts have disrupted the Phish ‘n’ Ships operation, where key tactics include specialized alerting, search engine removal of fraudulent listings, payment processor account removal, and law enforcement engagement. 

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!