8 minmedium
Black Friday Deals: Trojans, Phishing, Crypto Coin Mining
Zscaler ThreatLabZ documents a seasonal increase in malicious activity coinciding with Black Friday/Cyber Monday shopping, including domain squatting on the '.blackfriday' TLD to impersonate Google and distribute the Fareit and Loki infostealers, browser-based cryptocurrency mining scripts embedded in shopping-themed sites, fraudulent e-commerce storefronts, and spear-phishing documents using holiday bonus/gift card lures to deliver embedded malicious applications. The techniques primarily rely on social engineering and typosquatted infrastructure rather than software exploitation.
Conf:medium
Showing defanged values
- domaingooogle[.]blackfridayTyposquatted domain impersonating Google using the '.blackfriday' TLD; hosted a fake Microsoft Outlook phishing page and delivered the Fareit infostealer.
- domainguugle[.]blackfridayTyposquatted domain impersonating Google using the '.blackfriday' TLD; used as command-and-control server for the Loki infostealer, believed spread via malicious email campaigns.
- domainrayban-outlet[.]usFraudulent e-commerce storefront impersonating a Ray-Ban outlet store, appearing in top Google search results for sunglasses deals, registered to an address linked to 18 other fraudulent domains.
- emailjyt[.]832104[@]gmail[.]comRegistrant email associated with the rayban-outlet.us fraudulent domain and 18 other websites per DomainTools records.
- filenameBlackFridayBonusRegistration.docxMalicious phishing document with a Black Friday-themed lure and embedded application that installs malware when opened.
- filenameGiftCardRegistration.docxPhishing document using Neuberger Berman/PerksAtWork branding to lure victims into opening an embedded malicious application.
- md576c016592f189d6de4166c5907f5063bMD5 hash of Fareit infostealer sample delivered via gooogle.blackfriday.
- md5ab8f64e3d30ab00518935c1e68617f73MD5 hash of Loki infostealer sample using guugle.blackfriday as C2.
Detection / HunterAnthropic
What Happened
This article from Zscaler describes how cybercriminals take advantage of Black Friday and holiday shopping season to trick people online. They register fake websites with names that look almost identical to trusted brands (like Google), which then either steal passwords or secretly use visitors' computer processing power to generate cryptocurrency (called 'cryptojacking') without permission. Anyone who shops online, especially on a computer, could be affected, and clicking a bad link or opening a disguised email attachment could lead to stolen passwords or malware installation. This matters because these scams are timed to exploit the rush and distraction of holiday shopping, making people more likely to click without checking carefully. The article recommends double-checking website addresses before clicking, avoiding suspicious email attachments, using multi-factor authentication, keeping software updated, and using browser extensions that block ads and unwanted mining activity.
Key Takeaways
- Threat actors register lookalike domains using seasonal TLDs (e.g., '.blackfriday') that mimic legitimate brands like Google to distribute malware and phishing pages.
- Two identified '.blackfriday' domains were used to deliver the Fareit infostealer via a fake Outlook phishing page and to serve as C2 infrastructure for the Loki infostealer.
- Cryptocurrency mining scripts embedded in shopping-themed websites were observed being blocked, indicating attackers are riding holiday shopping traffic to monetize CPU resources without consent.
- Fake e-commerce sites (e.g., a fraudulent Ray-Ban outlet) impersonating legitimate retailers rank in search results and are tied to registrants with multiple other fraudulent domains.
- Spear-phishing documents themed around Black Friday/holiday bonuses (e.g., 'Black Friday Bonus Registration.docx' and 'Gift Card Registration.docx') use corporate branding to trick victims into executing embedded malicious applications.
Affected Systems
- Windows PC users (non-mobile shoppers primarily targeted)
- Microsoft Outlook users (phishing page targeting Outlook credentials)
- Web browsers visiting compromised or malicious shopping sites
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attacker registers typosquatted domains (e.g., using '.blackfriday' TLD) visually similar to trusted brands, or sends spear-phishing emails with holiday-themed lures.
- Delivery: Victims visit lookalike domains via search results/email links or receive malicious attachments (e.g., 'Black Friday Bonus Registration.docx').
- Execution/Credential Harvesting: Fake Outlook phishing pages harvest credentials, or embedded applications in documents install infostealers (Fareit, Loki) upon execution.
- Command and Control: Infected hosts communicate with attacker-controlled squatted domains (e.g., guugle.blackfriday) for data exfiltration.
- Monetization: Additional monetization occurs via embedded cryptocurrency mining scripts on compromised/malicious shopping sites, consuming victim CPU resources without consent, and via fraudulent e-commerce stores collecting payment/personal data.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Zscaler internal log search query (referer URL keyword search)
The article shows a sample referer URL keyword-based search query (visible in Fig. 3) used internally by Zscaler to identify shopping-themed referer URLs associated with cryptocurrency mining attempts; no formal YARA, Sigma, or Snort/Suricata rules are provided.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Most techniques described (phishing pages, domain squatting, browser-based cryptomining) occur primarily at the network/browser layer rather than generating strong endpoint process telemetry, though infostealer execution (Fareit, Loki) would produce process and file creation events on the host. |
| Network Visibility | Medium | Domain/URL-based indicators (squatted domains, referer URL patterns) are visible via web proxy, DNS, and secure web gateway logs, but detection relies on recognizing brand-impersonation patterns rather than known-bad signatures. |
| Detection Difficulty | Moderate | Typosquatted domains and fake shops require content and brand-similarity analysis rather than static signatures, and cryptomining scripts can be dynamically obfuscated in web pages, making purely signature-based detection insufficient. |
Required Log Sources
- Web proxy/secure web gateway logs
- DNS query logs
- Email gateway logs
- Browser process/network telemetry
- WHOIS/domain registration monitoring feeds
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Search for outbound DNS/web requests to newly registered domains containing seasonal shopping keywords combined with unusual TLDs, which may indicate visits to typosquatted or fraudulent retail sites. | DNS logs, proxy logs, domain registration age/WHOIS data | Initial Access / Delivery (T1583.001) | Medium - legitimate retailers may also register seasonal promotional domains. |
| Identify referer URLs containing shopping-related keywords (e.g., 'sale', 'deal', 'blackfriday') that correlate with spikes in CPU utilization or known cryptomining script signatures in browser sessions. | Web proxy referer URL logs, browser resource utilization, network traffic patterns to mining pool infrastructure | Resource Hijacking / Impact (T1496) | Medium - legitimate high-traffic shopping sites could also show elevated referer keyword matches. |
| Monitor for email attachments with holiday/bonus/gift-card themed filenames (e.g., containing 'Bonus', 'Registration', 'Gift Card') combined with embedded executable objects in Office documents. | Email gateway attachment scanning, Office document OLE object inspection | Delivery / Execution (T1566.001, T1204.002) | Low - legitimate business documents rarely embed executable applications. |
| Look for endpoint process creation consistent with infostealer behavior (e.g., processes reading browser credential stores) shortly after a user visits a newly observed domain with a seasonal-themed TLD. | EDR process creation and file access logs, browser credential store access events | Credential Access (T1555.003) | Low - password manager/browser sync tools are the main expected legitimate access pattern to distinguish from. |
Control Gaps
- Standard blocklists may not catch newly registered typosquatted domains before they are categorized as malicious.
- Ad-blocking/anti-cryptomining browser extensions are not deployed by default, leaving unprotected browsers vulnerable to CPU-hijacking scripts.
- Email security controls that do not inspect embedded OLE objects in Office documents may miss malicious application delivery via seemingly benign attachments.
Key Behavioral Indicators
- Domains combining shopping-season keywords with atypical or highly specific TLDs (e.g., '.blackfriday')
- WHOIS registrant emails linked to numerous other recently registered domains
- Sudden spikes in browser CPU usage correlated with visits to shopping-themed referer URLs
- Email attachments with holiday bonus/gift card-themed filenames containing embedded executable objects
False Positive Assessment
Medium - Behavioral indicators like shopping-keyword referer URLs and seasonal domain registrations can overlap with legitimate retail marketing activity, requiring contextual analysis (e.g., WHOIS history, brand similarity) to avoid false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; consider blocking known malicious domains (e.g., squatted '.blackfriday' domains) at the DNS/proxy layer where feasible.
- Consider scanning email gateways for attachments with seasonal/bonus-themed filenames and embedded executable objects.
- If your web filtering/proxy solution supports it, consider flagging traffic to newly registered domains combining shopping keywords with unusual TLDs.
Infrastructure Hardening
- Evaluate deploying secure web gateway or DNS filtering solutions capable of detecting typosquatted/lookalike domains.
- Consider integrating WHOIS/domain registration monitoring to flag newly registered domains resembling your organization's brand or major online retailers.
- Where supported by your tooling, consider enabling browser policies to block known cryptomining scripts or CPU-intensive scripts by default.
User Protection
- Consider deploying browser extensions (e.g., ad blockers, anti-cryptomining tools) across managed endpoints if compatible with your environment.
- If applicable, ensure operating systems and browsers are kept up to date with the latest security patches.
- Consider enforcing two-factor authentication on sensitive accounts, particularly banking and email, where supported.
Security Awareness
- Consider incorporating seasonal phishing awareness training ahead of major shopping events like Black Friday and Cyber Monday.
- Remind users to inspect URLs carefully and verify HTTPS/secure connections before entering credentials or payment information.
- Encourage users to avoid unofficial mobile app stores and public Wi-Fi when shopping online, and to back up documents/media regularly.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Command and Control
Tactic
