Hackers Registered 18,000 Holiday-Themed Domains Targeting ‘Christmas,’ ‘Black Friday,’ and ‘Flash Sale’

The 2025 holiday season has unleashed an unprecedented wave of cyber threats, with attackers deploying industrialized infrastructure to exploit the global surge in online commerce.

This year’s threat landscape is characterized by a calculated expansion of deceptive digital assets, where criminals leverage automated tools to scale their operations across multiple merchant categories.

The primary vector for these campaigns involves the mass creation of look-alike websites designed to mimic legitimate retailers and capture sensitive consumer data during peak shopping periods.

One of the most significant indicators of this pre-holiday offensive is the registration of over 18,000 holiday-themed domains in the past three months alone.

Targeting high-traffic keywords such as “Christmas,” “Black Friday,” and “Flash Sale,” these domains serve as the backbone for phishing schemes and fraudulent storefronts.

Many of these sites mimic household names with slight URL variations, making them nearly indistinguishable to hurried shoppers.

While a portion of these domains remain inactive to evade early detection, hundreds have already been weaponized to host gift card scams and payment-harvesting pages.

Fortinet security analysts identified this extensive network of malicious infrastructure, noting that the campaign’s scale facilitates effective SEO poisoning.

By artificially inflating the search rankings of these malicious URLs, attackers ensure their fraudulent sites appear alongside legitimate results during peak traffic.

The researchers further highlighted a disturbing rise in credential theft, with over 1.57 million login accounts from major e-commerce sites currently circulating in underground markets.

These “stealer logs” contain browser-stored passwords, cookies, and session tokens, enabling rapid account takeovers that bypass traditional login defenses (Figure 1: Domain Registration Trends).

Technical Exploitation of Platform Vulnerabilities

The sophistication of these attacks is most evident in the targeted exploitation of critical e-commerce vulnerabilities. Attackers are actively leveraging CVE-2025-54236, a critical flaw in Adobe Magento caused by improper input validation.

This vulnerability allows threat actors to execute a remote code execution (RCE) attack, effectively bypassing authentication layers to achieve session takeover.

By injecting malicious payloads into unvalidated input fields, attackers gain administrative access, enabling them to install persistent backdoors or JavaScript-based web skimmers directly onto checkout pages.

Additionally, the exploitation of CVE-2025-61882 in Oracle E-Business Suite permits unauthenticated RCE, allowing ransomware groups to paralyze backend inventory systems.

These technical incursions are executed via automated scripts that continuously probe for unpatched systems, transforming a single vulnerability into a gateway for massive data exfiltration.

This systematic exploitation underscores the critical need for merchants to apply patches immediately.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.