'SilkSpecter' hacking operation uses sophisticated ring of 4,700 spoofed storefronts to dupe shoppers looking for Black Friday deals—here's how to avoid getting scammed

pcgamer.com:

Sometimes a Black Friday deal really is too good to be true. As you might already suspect, the fast approaching winter quarter is prime time for scammers, and every year fake online storefronts become more sophisticated, working harder than ever before to part you from your hard-earned cash.

The Guardian reports that last Christmas shoppers in the UK lost £11.5m to scams leveraging a sophisticated arsenal of social media posts, online marketplaces, and AI. The newspaper notes that fairytale deals on high-end tech is just one tactic cybercriminals use to dupe shoppers. 

If you needed further convincing of just how widespread the issue is, the EclecticIQ threat research team have identified a ring of close to 4,700 fake online storefronts targeting shoppers specifically looking for Black Friday discounts across the US and Europe (via BleepingComputer). 

First identified in October earlier this year, EclecticIQ's analysts believe with «high confidence» that, based on the IP addresses involved, the scam ring is being operated by Chinese hackers and have dubbed this group 'SilkSpecter.' Their scam ring impersonates storefronts of well-known brands such as Makita, Ikea, and the North Face.

These spoofed sites can convince at a glance, but closer inspection of their URLs will reveal an unusual top-level domain like '.shop' or '.store'. Many of these webpages will encourage shoppers to use legitimate payment methods such as Stripe, but it's not just your money these fake fronts are after.

For a start, the fake Black Friday webpages deploy trackers OpenReplay, TikTok Pixel, and Meta Pixel to collect metadata from victims—such as their location, browser, and OS details. This is in part to dynamically translate the page's text based on the victim's IP address, but scraping this user data can also be used by hackers to assess the success of their scam.

ElectricIQ also shares that these spoofed store fronts leverage Stripe to allow «genuine transactions to be completed while