According to a new investigation, an extensive brand impersonation campaign targeting over a hundred popular clothing and footwear brandshas been underway since June 2022. The fake sites that have been created and imitate popular brands are tricking people into entering credentials and financial information.
Fake sites impersonate brands, such as Nike, Puma, Asics, Vans, Adidas, Columbia, Superdry Converse, Casio, Timberland, Salomon, Crocs, Sketchers, The North Face, UGG, Guess, Caterpillar, New Balance, Fila, Doc Martens, Reebok, Tommy Hilfiger and others.
The Bolster, which discovered the campaign, reports that there are at least 3,000 domains and about 6,000 fake sites, including inactive ones.
See also: Pink Drainer group impersonates journalists in phishing attacks
Bolster reports that an increase in the campaign's activity was observed between January and February 2023, with 300 new fake websites per month.
Domain names usually include the brand together with a city or country, followed by a generic TLD such as “.com”.
Researchers report that the brand impersonation campaign included more than ten fake websites for the Nike, Puma and Clarks brands . The fake sites closely resemble the companies' official, legitimate sites.
Most domains have been registered through Alibaba.com Singapore and the domain age ranges between two years and 90 days.
Domain age is a critical factor in phishing, as the longer a domain remains “alive”, the less likely it is to be flagged as suspicious by tools .
See also: “Inferno Drainer”: New crypto phishing service targets thousands of victims
In the campaign Bolster discovered, many of the malicious domains survived so long without being reported that Search Google ranked the sites high for certain search terms.
This is an effective strategy to attract users to a phishing website, as most people associate high rankings in Google with credibility.
According to BleepingComputer, the fake sites that mimic popular brands in this brand impersonation campaign are crafted with great detail and look realistic. They include “About Us” sections and contact information, while the order pages work as expected. They are difficult to identify as suspicious.
We don't know what specific form of fraud is being used in this campaign, but Bolster suggests that the perpetrators behind the campaign are either not sending the supposed products that users or are sending Chinese knockoffs.
Additionally, any information entered on payment pages, notably details , can be stored by the website operators and resold to cybercriminals.
See also: New PhaaS “Greatness” simplifies Microsoft 365 phishing attacks
How to avoid the scam?
When searching for a brand's official website, avoid opening promoted results in Google. If you're still unsure, check the brand's social media page for the legitimate URL.
This brand impersonation campaign shows how important it is to be careful when browsing and shopping online. Users should check the authenticity of websites.
If you encounter a product price that seems too good to be true, you should take additional measures to verify the legality of the domain.
Source: www.bleepingcomputer.com
