Amazon Prime Day 2022 is set for July 12 and 13, and already July has seen a 37% jump in Amazon-themed phishing attacks according to cyber threat intelligence provider Check Point Research (CPR). Additionally, CPR also reports that roughly 1,900 new domains with the term “Amazon” showed up in June, with almost 10% of them found to be either malicious or suspicious. “In the weeks prior to Prime Day 2021, CPR discovered 2,303 new Amazon-related domains with most of them (78%) found to be risky. Our researchers believe that this decrease could partly be explained by cybercriminals not always having the full term “amazon” included in the domain being registered for phishing purposes to avoid detection. Furthermore, these cybercriminals might leverage these domains for a later use, and do not want them to contain content that could be deemed malicious.”
CPR notes that while the themes of phishing campaigns evolve to address current events, the tactics they use remain largely the same. The emails come in a variety of templates, including one that informs recipients of a canceled order due to payment issues. The user is directed to download an invoice that contains malware. Another email tells users that their payment method needs to be confirmed, and contains a link to a phishing site.
“One of the most common techniques used in phishing emails are lookalike or fake domains that appear to be a legitimate or trusted domain at a casual glance,” the researchers write. “For example, instead of the email address boss@company.com, a phishing email may use boss@cornpany.com or boss@compаny.com. The first email substitutes rn for m and the second uses the Cyrillic а instead of the Latin a. While these emails may look like the real thing, they belong to a completely different domain that may be under the attacker’s control.”
Threats from cybercriminals are always evolving and extend well beyond the business enterprise, affecting many aspects of our daily lives. To take preventative steps and implement ongoing Security Awareness Training at your organization, contact Radiant Resources today.