Black Friday Malware Campaigns: What Shoppers Need to Know This Year
Black Friday is no longer a single morning of crowded aisles. It is a six-week stretch of email blasts, flash sales, and checkout pages most shoppers have never seen before, and that is exactly the environment malware crews build for. From late November through the January sales, fake storefronts, poisoned ads, and payment skimmers appear faster than platforms can take them down. Shoppers are rushed, spending more than usual, and primed to expect unfamiliar websites. Those three things together hide the small details that would normally make you stop and look twice.
Why the Season Works in Attackers' Favor
Cybercrime follows attention and money, and the holiday window supplies both in volume. Retailers push limited-time discounts, which trains people to click fast and to accept that a shop they have never heard of might be legitimate. Order confirmations, shipping updates, and refund notices become background noise, which makes them ideal cover for phishing. At the same time, thousands of small merchants spin up new stores, new domain names, and new checkout integrations, and nobody has the time to vet all of it.
Attackers rarely need a clever new exploit. They need you tired at eleven at night, reasonably convinced the deal is real, and willing to enter a card number into a page that looks close enough to the brand you trust.
Fake Shopping Sites: Believable by Design
A convincing fake store costs almost nothing to build. The layout is copied from a real retailer's theme, the product photos are lifted from the manufacturer, and the reviews are generated or scraped. What gives it away is usually in the details rather than the design.
Look at the domain name, letter by letter. Common tricks include an extra hyphen, a doubled consonant, a switched pair of letters, or a brand name followed by a random word. Prices that sit well below every other seller are a warning, not a bargain, especially on consoles, graphics cards, designer goods, and anything with limited stock. So is a site that accepts only gift cards, cryptocurrency, wire transfer, or a direct peer-to-peer payment. Those methods are hard or impossible to reverse, which is precisely why they are requested.
Before you buy, find the returns policy, a physical address, and a way to contact a human. If the contact page is a generic form and the address is a mailbox service or missing entirely, close the tab. A quick search for the shop's name plus the word "scam" takes ten seconds and often settles the question.
Web Skimmers: When the Real Store Is the Problem
Web skimming, sometimes called formjacking, works differently. Instead of luring you to a fake shop, attackers inject malicious JavaScript into a genuine store's checkout page. Your browser shows the real brand, the real certificate, and the real prices. The script quietly copies card data as you type it and sends it off before the order is even confirmed.
Entry points are mundane: an outdated content management system, a compromised third-party script that handles reviews or analytics, or stolen administrator credentials. That is why a padlock in the address bar proves less than people assume. HTTPS means the connection is encrypted; it says nothing about whether the site has been cleaned of injected code.
You cannot audit a retailer's JavaScript from your sofa, but you can limit the damage. A virtual card number from your bank or a payment service that does not hand your real card details to the merchant is the single most useful protection here. If a checkout form asks for your card PIN, your online banking password, or a one-time code from your bank, stop. No legitimate store needs any of those.
Malvertising, Coupon Traps, and Delivery Phishing
Search ads are a favourite tool. Attackers buy placement on brand keywords so their listing appears above the real store, often with a near-identical domain. Typing the address yourself or using a bookmark avoids the whole problem.
Browser extensions deserve the same suspicion. Deal finders and coupon injectors often request permission to read and modify every page you visit, which is enough access to rewrite links or harvest checkout data. Install few, review the permissions, and remove anything you no longer use.
Then there is the inbox and the phone. Fake order confirmations, fake delivery problems, fake refunds, and fake "your payment failed" texts all spike between November and January. The link leads to a credential-harvesting page or a malware download. If a message about an order surprises you, open the retailer's site directly or use its app rather than clicking. The same applies to cloned shopping apps offered outside the official app stores, which are a common route to banking trojans on Android.
Red Flags Worth Memorising
- A domain that is almost, but not quite, the brand you meant to visit.
- Prices far below everyone else on in-demand items.
- Payment accepted only by gift card, crypto, wire, or peer-to-peer transfer.
- No physical address, no phone number, no returns policy.
- Countdown clocks and "only two left" pressure you cannot verify.
- Checkout asking for a PIN, banking password, or bank one-time code.
- Certificate warnings or browser security alerts you are told to ignore.
- Order or refund emails for purchases you never made.
- Blurry logos, odd fonts, and text that reads like it was translated twice.
A Short Holiday Shopping Routine
- Reach stores by typing the address or using a bookmark, never through an ad or an email link.
- Pay by credit card or a virtual card number. Skip debit cards, wires, crypto, and gift cards.
- Let a password manager fill your logins. It will not autofill on a lookalike domain, which is a useful warning in itself.
- Turn on transaction alerts with your bank so an unexpected charge reaches you immediately.
- Update your browser, operating system, and extensions before the sales start, not during them.
- Enable two-step verification on retail accounts and change any password you have reused elsewhere.
- Keep confirmation emails and receipts until the parcel arrives.
None of this takes long. Most of it happens once and then quietly protects you for the rest of the season.
If You Think You've Been Hit
Speed matters more than perfection. If you entered card details on a suspicious page, call the number on the back of your card, ask for the card to be frozen or replaced, and review recent transactions line by line. Under most card schemes you are not liable for fraudulent charges, but you have to report them promptly, and the sooner you do it, the simpler the dispute.
If a retail account was accessed, change that password and then change it anywhere else you reused it. Check the account's saved addresses and payment methods for anything you did not add, and switch on two-step verification. If you downloaded a file or app, disconnect the device from the network and run a reputable security scan; for a work laptop, tell your IT team before doing anything else. Report the site or message to your national cybercrime reporting portal and to the brand being impersonated, which helps get it taken down.
And if real money or your identity is involved, treat it as a financial matter rather than a technical one. Your bank's fraud team, and where the amounts are significant a qualified professional, can advise on steps that go well beyond changing a password.
