Holiday retail phishing spikes earlier and spreads across channels

At a glance

What this is: This report shows that holiday phishing infrastructure is being built earlier in the season, with attackers using seasonal urgency, fake storefronts and multi-channel promotion to capture payment data and personal information.

Why it matters: It matters because identity teams, fraud teams and security operations need to detect impersonation and credential-harvesting infrastructure before shoppers encounter it, not after the scam has already converted traffic into fraud.

By the numbers:

• PreCrime Labs identified 1,728 domains suspicious and malicious in nature between 15 September and 10 November 2025.
• October 2025 saw 854 domain creations, making it the highest month for new registrations.
• NameSilo accounts for 334 registrations.
• About 7.9% of the domains analysed were identified as domain-generation-algorithm based.

Context

Holiday phishing succeeds because seasonal commerce creates an unusually dense mix of urgency, trust and impulsive clicking. Attackers exploit that behaviour by registering themed domains, pushing fake offers through ads and messaging channels, and imitating retail, travel and gifting experiences that users already expect to see in peak shopping periods.

The identity problem is not limited to fake websites. These campaigns also borrow brand names, login prompts and payment flows to harvest credentials and card data, which means fraud controls, threat intelligence and phishing defence need to work together before the user reaches the checkout page.

Key questions

Q: How should retail security teams prepare for seasonal phishing spikes?

A: Retail teams should increase monitoring, user awareness, and escalation coverage before the seasonal peak arrives, not after the first wave of attacks. They should also validate that mail filtering, reporting, and approval workflows are aligned to the higher transaction volume seen in Q2. Seasonal readiness works best when it is operationally planned, not improvised during the incident.

Q: Why do seasonal phishing campaigns convert so well at checkout?

A: They exploit existing buying intent. When users expect discounts, delivery updates or festival offers, they are more willing to click, log in and pay without the normal scepticism they would apply to an unknown site. That makes checkout the point where brand familiarity, identity trust and payment risk converge.

Q: What are the signs that holiday fraud infrastructure is being built early?

A: Watch for clusters of newly registered domains with seasonal keywords, unusual TLDs, repeated naming patterns and rapid expansion across ads or social channels. Those signals usually mean the campaign is being staged ahead of the shopping rush, which gives attackers time to scale before users are most alert.

Q: How should security teams reduce the risk of crypto drainer phishing campaigns that rely on social media and messaging apps?

A: Security teams should treat unsolicited giveaway messages, wallet connection prompts, and lookalike brand pages as high-risk phishing events. Defenses should combine user awareness, URL scrutiny, account hygiene, and phishing-resistant controls around wallet interactions. Because these campaigns are designed for low-skill operators, the most effective response is to make credential stuffing, spoofed pages, and rapid fund transfer less likely to succeed.

Technical breakdown

Why holiday phishing infrastructure appears before peak shopping windows

Holiday campaigns are often staged weeks in advance because attackers want domain age, search visibility and distribution paths ready before consumer attention spikes. Domain generation patterns, keyword-packed registrations and themed TLDs help malicious sites look legitimate long enough to capture traffic. The earlier build-out also gives criminals time to test redirect chains, ad placements and social distribution before the highest-value dates arrive. Practical implication: monitor registrations, ads and social distribution before seasonal demand peaks, not only during them.

Practical implication: Prioritise pre-peak domain monitoring and takedown workflows for seasonal brand abuse.

How fake storefronts turn identity and payment trust into fraud

A fake storefront is effective because it borrows the visual and behavioural cues of a real commerce journey. The attacker does not need to break the platform itself if the victim willingly enters credentials, card details or personal data into a convincing clone. That makes checkout the critical control point, where brand impersonation, session capture and payment fraud converge. Seasonal discount language lowers scepticism and increases conversion. Practical implication: apply brand protection, fraud monitoring and checkout verification as one control surface. See the Phishing Guide.

Practical implication: Treat checkout and login pages as a fraud control surface, not just a web presence issue.

Why social and messaging channels extend the attack surface

Phishing no longer depends on email alone. Social media ads, Telegram coupon groups and messaging apps allow attackers to bypass traditional gateway controls and reach users in places where urgency and peer-style sharing create trust. This is particularly dangerous in holiday seasons, when people are primed to click fast and compare deals. The channel is part of the attack path, not just the lure. Practical implication: extend detection and takedown coverage to ads, social posts, coupon groups and short-link ecosystems. See the Phishing Simulation Programme Guide.

Practical implication: Expand monitoring beyond email to the social and messaging channels where holiday scams now spread.

Threat narrative

Attacker objective: The attacker’s objective is to convert seasonal trust into monetisable identity, payment and account data before the victim realises the offer is fake.

1. Entry occurs through seasonal lure distribution, including fake storefronts, ads, social posts and messaging-channel promotions that present themselves as legitimate holiday offers.
2. Credential harvesting follows when victims enter login details, social media credentials or payment data into cloned pages or reward-fraud flows.
3. Impact occurs through account takeover, payment theft, personal-data capture and downstream fraud such as redirecting victims into gambling, crypto or resale scams.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Seasonal phishing is a governance problem, not just a volume problem. The article shows that attackers are operationalising holidays as a repeatable trust event, with domain registration, ad placement and social distribution all aligned to the same objective. That means the control question is no longer whether a brand can remove one bad site, but whether it can see the campaign before the first click. Security teams should treat seasonal brand abuse as a standing operational risk, not a seasonal surprise.

Identity trust is being exploited at the moment of transaction. These campaigns do not rely only on generic lures. They copy login prompts, gift flows and checkout behaviour because the victim is already primed to authenticate, pay or share personal data. That creates a direct intersection with identity verification and fraud governance, especially where consumer identity and payment identity are being asserted in the same flow. Teams should align brand protection with fraud detection and login-risk controls.

Pre-registration and monitoring are now part of defensive identity governance. When the attacker’s asset is a domain that impersonates a brand, the defensive answer has to start before the domain is live. That means tracking suspicious naming patterns, registrar concentration and seasonal keyword abuse as governance signals, not just SOC noise. The practical conclusion is simple: if a team only responds after malicious traffic appears, it has already lost the trust contest.

Multichannel impersonation creates a verification trust gap. The same campaign can move from search ads to Telegram to a spoofed checkout page without breaking the user’s mental model of legitimacy. That is why point controls fail when the surrounding trust chain is not governed. Practitioners should verify that brand, fraud and SOC teams are working from the same threat picture when seasonal campaigns spike.

Holiday fraud increasingly behaves like a distributed access problem. The article’s mix of domain abuse, counterfeit login pages and payment theft shows how quickly a single lure can become a multi-step compromise path. For identity and fraud teams, the lesson is to monitor where trust is granted, not just where authentication fails. Impersonation defence becomes materially relevant when seasonal campaigns are engineered to look socially familiar.

From our research library:

• Impersonation fraud accounted for over 85% of all fraud attacks in 2025.

What this signals

Seasonal impersonation will keep pushing identity teams toward earlier detection. The operational shift is from reacting to fake stores to spotting campaign setup patterns, especially the combination of domain registration bursts, ad placement and social distribution. Teams that still monitor only after customer reports are arriving too late to change exposure.

Holiday fraud now sits at the intersection of fraud, brand protection and access governance. The same lure can capture a credential, a payment card and a user session in one flow, which means separate controls produce blind spots. Practitioners should expect seasonal abuse to keep expanding across channels rather than concentrating in one inbox or one platform.

Verification trust gap: attackers win when the user recognises the theme but not the source. That gap widens during major retail and festival periods, so controls must make legitimacy easier to prove than to imitate, from domain monitoring through to checkout validation.

For practitioners

• Pre-register seasonal brand domains Reserve likely combinations of your brand, discount terms and seasonal events before attackers do, including sale, Black Friday, Christmas and festival variants.
• Monitor new registrations for campaign patterns Track sudden spikes in keyword-heavy domains, unusual TLDs and registrar clustering so suspicious infrastructure can be triaged before peak shopping traffic arrives.
• Extend takedown coverage to ad and social channels Review paid placements, social posts, coupon communities and messaging groups as part of the same abuse workflow, because holiday scams often move across all four.
• Align checkout protection with fraud detection Treat brand impersonation, credential capture and payment theft as one flow so that suspicious login and checkout behaviour is investigated together.
• Issue seasonal advisories before demand peaks Warn customers and employees about holiday scams before Black Friday, major festivals and year-end sales periods, and reinforce direct-navigation habits to official sites.

Key takeaways

• Holiday scams are not only persistent, they are moving earlier in the retail calendar and spreading through multiple distribution channels.
• The report’s evidence shows a large pre-December domain build-out, with 1,728 suspicious or malicious domains identified in a short monitoring window.
• The most effective defensive response is upstream: pre-register brand domains, monitor campaign signals early and unify fraud, brand and SOC response paths.

Related NHI Mgmt Group resources: Phishing Guide · Phishing Simulation Programme Guide · Deepfakes, Social Engineering and AI Impersonation Guide · Threat Hunting Guide

Key terms

• Holiday Phishing: Holiday phishing is a social engineering campaign that exploits seasonal shopping and travel activity to make fraudulent messages look routine. Attackers imitate shipping notices, retail offers, and booking confirmations to prompt quick clicks, credential entry, or payment disclosure. The tactic works by combining timing, urgency, and familiar consumer habits.
• Domain generation algorithm: A domain generation algorithm is code that creates many possible command-and-control domains, usually on a schedule or from seed values. It helps malware recover from server loss and frustrates blocklists because defenders must predict the next set of domains rather than block a fixed address.
• Brand impersonation fraud: A fraud pattern in which attackers mimic trusted organisations to trigger urgent action, capture credentials, or collect payment data. The technical risk sits at the intersection of identity verification, channel assurance, and user trust, which is why security and fraud teams both own the response.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and identity practitioners connect identity controls to the wider attack paths their programmes must govern.