Spam campaign roundup: Thanksgiving weekend edition

November 22, 2017

Everyone is gearing up for the Thanksgiving weekend. While consumers take advantage of retailers' pre-Black Friday deals which have started earlier and earlier in recent years, cybercriminals are also trying to get an early leg-up on the holiday shopping.

The SonicWall Capture Labs Threat Research Team has observed that this year is no different. Cybercriminals are shopping for your personal data as more consumers turn to online shopping. The statistics we have gathered for this year indicates that users who shop on Amazon online has more than doubled as compared to last year.

The spam emails we have seen have a common theme of trying to lure consumers to click on the links and provide their personal information in exchange for early access to dooorbuster deals or a chance to redeem rewards for cash and gift cards from popular retailers.

The following are some of the common email subjects:

  • Amazon Early Black Friday Giveaway
  • Check out Walgreens Early Black Friday Bonus.
  • BLACK FRIDAY PRE-SALE Now! Get FREE DELIVERY Up To 80% Off On All UGG Order
  • Your Sams Club black friday member points: Get yours
  • Get your black friday Sams Club member reward #58246103

These emails are pretending to come from popular retailers like Amazon, promising cash rewards. The link referenced on the email will often take you to a website different from the actual retailer's website. The consumer will then be asked to enter their personal information and to participate in a number of "offers" often costing money in fees or subscriptions without the guarantee of ever receiving the products and services or the free cash reward at the end of the process.

Some emails are more blantant about asking for your bank account information in exchange for instant "holiday cash" like this example below:

We have seen scamsters attack other platforms as well to capitalize on the Black Friday/Thanksgiving shopping season. We reported recently in a blog about an Android app that is using the name Amazon but hiding the remote access tool DroidJack under its hood. Since many shoppers download and user apps that are related to shopping and deals this season, malware writers are trying all avenues to spread their malicious creations and target unsuspecting shoppers.

We urge our users to always be vigilant and cautious with any unsolicited email and to avoid providing any personal information, particularly if you are not certain of the source.

Sonicwall Capture Labs and Email Security services constantly monitor and provide protection against such malicious spam and phishing threats.