If a Black Friday deal sounds too good to be true, it may not just be a phony promotion. It actually may be a cybercriminal looking to steal your credentials or credit card info. This post looks at the threats to be on the lookout for this holiday season and how consumers can protect themselves.
The Big Stakes for Black Friday
For retailers, the success of an entire year can often come down to the results that come in during a few days in November. For many of the top retailers in the U.S., Black Friday is one of the most significant revenue-generating days of the year.
This year, the National Retail Federation (NRF) estimates a record 166 million people are planning to shop between Thanksgiving and Cyber Monday (November 24-28). Black Friday, the day after Thanksgiving, is the day the biggest percentage of people will do their shopping over that weekend.
Industry watchers are expecting this big weekend to be part of a big holiday season. Compared to 2021, the NRF is forecasting that holiday sales during November and December 2022 will grow between 6% and 8% and reach up to $960.4 billion. One survey found that close to two-thirds of consumers said they plan to use their mobile phone or tablet to shop this holiday season.
Deals Aren’t All that Awaits Holiday Shoppers
Why do so many consumers flock to their local brick-and-mortar shops and online storefronts during the Thanksgiving weekend? For some, shopping on Black Friday is a tradition or a fun way to spend some vacation time. However, many are drawn to Black Friday shopping because they’re focused on getting some of the best deals of the year, whether it’s for holiday gift-giving or that special splurge that’s been on the wish list for months.
However, as consumers hunt out the best deal, they have to be careful they’re not the prey. That email promising impossibly steep discounts? It may actually be a cybercriminal looking to steal your data. Employing phishing and other tactics, attackers may offer these supposed great deals to try and lure targets onto their sites. Cyberattackers will emulate the sites of reputable retailers and other businesses, where they’ll attempt to dupe unwitting targets into submitting their credentials, bank details, and a range of other sensitive data that can be used for fraud, identity theft, and other nefarious purposes.
Sounds easy, right? Keep in mind that these fraudsters leverage the dark web to purchase malicious software and sophisticated websites designed with meticulous detail to dupe shoppers.
Cyberthreats to Worry About this Black Friday
According to a new report of the Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC), credential harvesting, social engineering tactics, and account takeovers all increase during the holidays. Following are a few of the key attack trends that RH-ISAC advises retailers to be on the lookout for.
Phishing and Credential Harvesting
Phishing and fraud remain top concerns for retailers this holiday season. The RH-ISAC reports that phishing activity remains extremely prevalent. Product promotions are common ways threat actors target consumers in order to gain access to personally identifiable information (PII). The organization is also seeing a rise in information stealers that attempt to harvest customer credentials.
Account Takeovers
Often, attackers will gain access to pilfered credentials and employ bots to attempt logins with those credentials on various travel, retail, and finance sites. Once they’ve identified sites where they can log in successfully, they can either use that access to commit fraudulent activities or sell those credentials to others.
Ransomware
The report reveals that, since the start of 2022, security analysts identified 39 instances of leaks associated with ransomware that targeted retailers. These retailers refused to pay the ransom or failed to do so in time, which resulted in the attackers leaking sensitive information, including customer data. It is likely many more retailers were targeted and paid the ransom to avoid this fate.
Malware
Following are a few of the forms of malware the organization expects to be employed frequently this holiday season:
- Emotet. The Emotet trojan is typically spread via phishing email attachments and links. Once these malicious files and links are accessed by a user, Emotet launches a payload that attempts to proliferate within a network, employing brute-force entry of user credentials.
- Qakbot. Qakbot is another form of information-stealing malware commonly reported on.
- Agent Tesla. Another example is a remote access trojan (RAT) known as Agent Tesla. If this trojan is installed on a device, attackers can gain full access to the device.
Zimperium Can Protect Consumers This Black Friday and Every Day
Particularly this Black Friday and Cyber Monday, the use of public Wi-Fi will be widespread. These Wi-Fis can present a number of risks. For example, cybercriminals will create rogue Wi-Fi networks that siphon a consumer’s personal information while they’re doing their shopping.
The good news is that consumers can take steps to guard their devices and data this holiday season. Today, leading enterprises, including top retailers, are using Zimperium solutions to protect their employee’s devices, sensitive corporate assets, and personal data.
Further, consumers can use Zimperium solutions as well. Large cities like Los Angeles, New York City, and the State of Michigan have teamed up with Zimperium to protect their residents.
Zimperium solutions protect Android and iOS mobile devices against critical threats. These solutions can alert shoppers when their devices are connecting to unsecured Wi-Fi networks, running unsafe apps in Android, exposed to system tampering, and more. Users will receive recommendations on what actions to take to keep their devices safe. Zimperium solutions never collect personal information from mobile devices; they only gather the threat information needed to protect consumers’ phones and tablets from cybercrime.
To learn more about how you can protect your mobile device and your enterprise against threats, be sure to visit https://www.zimperium.com/zips-mobile-ips/.
