Security researchers have warned online shoppers to be on their guard after revealing news of an extensive network of fake e-commerce stores designed to steal victims' card details and cash.
Operated primarily from China, the BogusBazaar network has processed over one million orders since 2021, according to Security Research Labs.
The security vendor estimated that over 850,000 shoppers have already fallen victim, mostly from Western Europe and the US. They're thought to have ordered over $50m worth of non-existent items since 2021, although not every order results in successful payment, so the financial damage is expected to be somewhat lower.
Even if payment isn't successful, the scammers behind the operation will be able to harvest the victim's card details and personal information via fake payment pages, SRLabs said.
In some cases, counterfeit items are shipped to the victim, but often they receive nothing.
Shoppers are lured to the fake web shops by legitimate-looking websites selling luxury and branded items at low prices.
The scammers typically choose expired domains with good Google reputation, with the stores running on the WooCommerce WordPress plug-in, Zen Cart or OpenCart.
SRLabs claimed that 22,500 domains are currently active, although it has recorded over 75,000 in total used by the network.
BogusBazaar uses servers located mainly in the US, with each running around 200 fake e-commerce stores, although some support more than 500.
Each server is associated with over 100 IP addresses.
Franchisees, again based mainly in China, manage day-to-day operations, SRLabs said.
SRLabs said it has shared its findings with network infrastructure operators, payment providers, search engines and other stakeholders in the hope they take action against the massive fraud operation.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Thu, 09 May 2024 14:40:05 +0000