"Phishing Kit Impersonates Well-Known Brands to Target US Shoppers"

Since mid-September, a sophisticated phishing kit has been targeting North Americans with lures themed around holidays such as Labor Day and Halloween. The kit employs a variety of evasion detection techniques as well as several mechanisms to keep non-victims away from its phishing pages. According to Akamai security researchers who discovered the campaign, one of the most intriguing features of the kit is a token-based system that ensures each victim is redirected to a unique phishing page URL. The campaign began in September 2022 and ran through October 2022, preying on online shoppers. The main theme of the phishing emails sent to potential victims is the opportunity to win a prize from a reputable brand. The links in the email raise no red flags because they lead to the phishing site after a series of redirections, and URL shorteners hide most URLs. Furthermore, the attackers take advantage of legitimate cloud services such as Google, AWS, and Azure, using their good reputation to circumvent security measures. After completing a short survey, everyone who visits the phishing site receives the promised prize. In addition, a five-minute timer instills a sense of urgency in those taking the survey. DICK'S Sporting Goods, Delta Airlines, Sam's Club, Costco, and more are among the impersonated brands. The phishing actors also included fake user testimonials showcasing the received prizes to increase the campaign's effectiveness. This article continues to discuss the phishing kit targeting North American online shoppers.

Bleeping Computer reports "Phishing Kit Impersonates Well-Known Brands to Target US Shoppers"