Hackers are expanding spam efforts disguised as delivery notifications or online shopping invoices this holiday season in an effort to gain access to payment card details, according to a new report from cybersecurity firm F-Secure Corp.

The report found that spam was once again the most common method for hackers to spread malware in 2018, counting for nine out of 10 infection attempts. About 69 percent of campaigns attempted to trick people into clicking on malicious web addresses.

“The kind of spam that criminals use doesn’t seem so spammy to a lot of people this time of year,” F-Secure behavioral science lead Adam Sheehan said. “More people are just more open to the commercial messages spammers like to spoof, which makes individuals more vulnerable at home and at work.”

Sheehan added that tests the firm performed using simulated Black Friday and Cyber Monday phishing emails saw about 39 percent more people click than similar tactics at other times during the year — not a positive trend.

The report looked at various attack methods being used with mixed results. Although the number of active exploit kits has declined by 33 percent over the last year and 87 percent since 2013, the use of Emotet, Trickbot and Panda banking trojans is on the rise.

The number of attempted ransomware attacks also declined, but a number of infection paths, such as with the trojans, often leave the door open for ransomware attacks to come after an initial infection.

Ryan Wilk, vice president of customer success at NuData Security Inc., told SiliconANGLE that traditionally phishing attempts targeting shoppers heat up right before the holidays as cybercriminals count on consumers being in a hurry when reaching for a coupon or trying to find a limited product online.

“These attacks are one of the strategies cybercriminals use to snag consumer credit card or account information,” Wilk explained. “They use this information to take over accounts or use the credit cards to steal goods and services online.”

Consumers need to stay vigilant on links, and many online retailers are now implementing a multilayered approach to identify real customers from fraudsters using stolen information, Wilk added. “With passive biometrics and behavioral analytics layers merchants worldwide are able to determine if the legitimate user is accessing and transacting on the account or if it is a cybercriminal at work, protecting online buyers and businesses from fraud,” he said.

Image: 132604339@N03/Flickr