Black Friday cyber-pariahs have revamped gift-card scams to better target modern online shoppers hungry for deals post-Thanksgiving. Experts warn new tactics include bogus gift-card generators that install malware designed to sniff out a victim’s cryptocurrency wallet address.
Internet-based Black Friday and Cyber Monday scams have become as common as the Macy’s Thanksgiving Day Parade. That’s why scammers save to trot out new ways to snare cyber-savvy shoppers. In a Tuesday-post, researchers at Malwarebytes Labs, outlined this year’s latest gift-card scams. One novel twist includes offering gift cards for significantly less than face value as a ploy to entice users to buy stolen gift-cards or download malware.
“If you see websites offering all kinds of discounts on gift cards, you can be assured that these will turn out to be fakes or they have been acquired in an illegal way and you could be acting as a fence,” wrote Pieter Artnz, Malwarebytes malware intelligence researcher.
Generating Scams, Not Gift Cards
Researchers said they have been tracking a number of websites that claim to provide “gift card generators” that people can use to generate the code for all kinds of gift cards. These sites can be particularly deceptive because they use major brands such as Amazon, Roblox, Google, Xbox and PS5.
The “lucky” people who fall victim to these scams will download gift-card generators and be informed just before trying to use them that they don’t actually generate valid gift-card codes, but only “random codes for ‘educational purposes,’” Artnz wrote. Likely this occurs after people fill out surveys and give up personal information.
However, these scams can get much more sinister, with the process to obtain a gift-card generator actually downloading malware to someone’s system, researchers said.
Artnz described one such scam that used a gift-card generator to steal cryptocurrency from victims using a file titled “Amazon Gift Tool.exe” that was being marketed on a publicly available file repository site as a free Amazon gift card generator.
“In reality, the malware watched a user’s clipboard to find text that matches the normal length of a certain type of cryptocurrency wallet address,” he wrote. “If other criteria were met, to ensure that the victim was involved in a Bitcoin Cash transfer, the malware replaced the string on the clipboard with the attacker’s Bitcoin Cash wallet address.”
The scam depends on the victim not noticing that his or her crypto wallet address is on the clipboard when pasting it during the transaction, they noted. If successful, the transfer goes to the cybercriminal instead of the intended recipient.
Choose a Better Gift
To avoid falling prey to these and other cybercriminal scams on Black Friday this year, people have a few options. They can choose to be more creative in their choice of presents, keeping in mind that many gift cards end up going unspent, Artnz wrote.
Indeed, according to a Juy 2021 survey by Bankrate, 51 percent of U.S. adults currently have unused gift cards, vouchers or store credits totaling roughly $15 billion in outstanding value.
Moreover, slightly less than that, 49 percent, of U.S. adults have lost a gift card, voucher or store credit at some point.
If people do decide to use Black Friday to shop for gift cards online, they can keep one simple rule in mind to avoid being defrauded, Artnz said.
“It always helps to keep in mind that if something sounds too good to be true, it is probably not true at all,” he wrote.
Cybersecurity for multi-cloud environments is notoriously challenging. OSquery and CloudQuery is a solid answer. Join Uptycs and Threatpost for “An Intro to OSquery and CloudQuery,” an on-demand Town Hall with Eric Kaiser, Uptycs’ senior security engineer, and find out how this open-source tool can help tame security across your organization’s entire campus.
Register NOW to access the on-demand event!