Cyber Security News

Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers

The Phish, ‘n’ Ships fraud operation leverages, compromised websites to redirect users to fake online stores, which, optimized for search engine visibility, trick victims into providing credit card details to third-party payment processors, resulting in financial loss without receiving any products. 

Phishing attacks exploit consumer demand for hard-to-find items, redirecting victims to fake online stores.

Once on these fraudulent sites, users unknowingly provide payment card information, which cybercriminals then steal.

The 2014 crowdfunding success of a silicone “Power Mitt Oven Glove” inspired a niche market for retro-themed kitchenware, which persists. Similar products remain unavailable despite significant initial interest and positive user feedback.

Various products presented on Google image search

It indicates a potentially fraudulent online listing for a product. The listing features watermarked images belonging to a different designer and online store, suggesting a deceptive attempt to sell a counterfeit or unauthorized version of the product with false promises of free shipping.

Build an in-house SOC or outsource SOC-as-a-Service -> Calculate Costs

The user clicked through to a fake online store with a website URL different from the original search result. Despite this discrepancy, the site appears somewhat legitimate, with customer reviews further adding to this illusion. 

Product reviews on the fake web store

The website lacks data validation for the phone number field during checkout, allowing invalid input and potentially compromising data security, which raises concerns about the platform’s overall security practices.

Victimized by a phishing attack, the consumer experienced financial loss and potential identity theft after providing sensitive payment information to a fraudulent online store, leading to a chargeback request with their payment processor.

Phish ‘n’ Ships attacks involve infecting legitimate websites with fake product listings, redirecting search traffic to these malicious listings, and ultimately transitioning users to fake web stores for fraudulent transactions.

diagram of the attack from the attacker’s perspective

Threat actors exploited n-day vulnerabilities to infect websites with malicious scripts, which injected fake product listings and optimized their search engine ranking, leading to malicious file downloads when unsuspecting users click on these listings.

The injected script, likely triggered by a user clicking on a compromised link, redirects the user to a malicious website under the control of threat actors, which are dynamically generated by a C2 server to evade detection and disruption.

Redirection to fake web store

The threat actors redirect users to hundreds of fake web stores, identified by URL strings like “product.aspx?cname=<ID>” or “product_details/<ID>.html”. These stores, hosted on 14 IP addresses, serve as a key pivot point for further investigation. 

They manipulate the checkout process to redirect users to a fraudulent website under their control, which allows them to capture the user’s payment card information through a payment processor gateway, ultimately leading to financial loss for the victim.

By leveraging a sophisticated toolset, they facilitate their malicious operations, which include tools for monitoring product trends, capturing product images, and diversifying payment methods, including direct payment card skimming.

According to HUMAN, recent collaborative efforts have disrupted the Phish ‘n’ Ships operation, where key tactics include specialized alerting, search engine removal of fraudulent listings, payment processor account removal, and law enforcement engagement. 

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Aman Mishra

Recent Posts

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as "GruesomeLarch"…

1 day ago

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based…

2 days ago

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central…

2 days ago

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India,…

2 days ago

Raspberry Robin Employs TOR Network For C2 Servers Communication

Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection…

2 days ago

145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks

Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report…

2 days ago