The holidays are rapidly approaching, so seasonal phishing campaigns are already emerging. These campaigns exploit seasonal behaviors, increased message volumes, and heightened urgency. Cyber threat actors commonly target both consumers and organization employees by taking advantage of typical year-end trends.
During the holidays, users expect to receive emails from familiar retailers about sales and coupons, order confirmations, and shipping updates. Cyber threat actors exploit these trends by using stolen branding to send spoofed emails that appear legitimate. These emails may include links or attachments that install malware or lead to websites that harvest credentials, steal financial or personally identifiable information (PII), or allow threat actors to gain remote access. Common lures targeting consumers may include:
- Failed Delivery and Shipping Alerts: Messages claim that a package cannot be delivered and that address confirmation is required, or that a small redelivery fee is due. These lures typically impersonate major carriers such as UPS, FedEx, or USPS.
- Exclusive Flash Sales and Deal Alerts: Emails or text messages that advertise steep discounts, limited-stock doorbusters, or fraudulent order confirmations for popular luxury items or electronics, and include links to websites that attempt to harvest credentials or credit card information.
- Charity and Gift Drives: Fraudulent donation requests exploit seasonal generosity. These lures imitate well-known non-profit organizations or use convincing, fabricated charity names.
- Gift Card and Loyalty Point Expirations: Notifications that unused holiday rewards, loyalty points, or digital gift cards will expire unless claimed immediately.
- Travel and Reservation Updates: Spoofed emails claiming flight delays, hotel booking confirmations, or last-minute holiday travel itinerary updates.
Organizations may also see an uptick in scams during the holiday season. Common end-of-year scams may include:
- Payroll, Bonuses, and Year-End Adjustments: Messages appear to come from HR or Management regarding end-of-year bonuses, holiday gift distributions, or mandatory open-enrollment changes.
- Urgent Q4 Invoices and Financial Close: Accounts payable and finance departments should exercise caution regarding messages that urge immediate payment before fiscal year-end account closures.
- E-Signature and Document Sharing Notifications: Phishing emails can impersonate platforms such as Docusign or SharePoint, prompting employees to update holiday schedules, sign policy attestations, or review documents.
- E-Card and Party Invites: Users may encounter malicious invitations or "holiday greeting cards" containing embedded links or weaponized attachments intended to capture session tokens or deploy initial access payloads.
Recommendations:
- Exercise caution with communications from known senders or legitimate platforms.
- Confirm requests from senders via contact information obtained from verified and official sources before taking action, such as clicking on links or opening attachments.
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Users who submitted credit card information to suspicious webpages are advised to contact their banking institutions to report the fraudulent purchases.
- Enable multi-factor authentication (MFA) and keep systems and browsers up to date.
- If victimized, disconnect from the internet and run anti-virus/anti-malware scans.
- If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.