Credential Abuse and Domain Spoofing Spike Ahead of Festive Shopping

Du'aine Davis

Observed in the wild

• Over 18,000 holiday-themed domains mimicking major retailers were registered in the past three months, targeting shoppers during peak periods like Black Friday and Christmas. These fraudulent sites host phishing pages, gift card scams, and payment-harvesting schemes, with SEO poisoning used to boost visibility. Analysts report 1.57 million stolen e-commerce credentials circulating on underground markets, enabling large-scale account takeovers.
• Threat actors leveraged industrialised, AI-driven tools for credential stuffing, phishing, SEO poisoning, and Magecart-style payment skimming. Attack infrastructure included instant-setup phishing hosts, website-cloning services, and automated SIP platforms for vishing and smishing. Vulnerabilities in plugins and APIs enabled remote code execution, privilege escalation, and database exfiltration. Criminal marketplaces commoditised stolen data, offering discounted card dumps and full customer databases during “holiday sales.”
• Organisations should enforce MFA, patch all e-commerce platforms and plugins, and monitor for lookalike domains. Deploy bot management, rate limiting, and anomaly detection to curb credential abuse. Scan for unauthorised script changes and payment-page tampering. Centralise logging for suspicious admin actions and session hijacking. Microsoft Defender users should enable real-time anti-phishing, web filtering, and behaviour-based anomaly detection to block malicious domains, stealer-log malware, and C2 traffic.

Cyberthreats Targeting the 2025 Holiday Season: What CISOs Need to Know | FortiGuard Labs