We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

Thousands of E-Stores Hacked to Show Fake Product Listings

Thousands of E-Stores Hacked to Show Fake Product Listings
Husain Parvez Published on 6th November 2024 Cybersecurity Researcher

In a major discovery, cybersecurity firm HUMAN Security has uncovered a sophisticated phishing campaign, dubbed “Phish n' Ships”. This elaborate scheme targeted over 1,000 legitimate e-commerce websites, leading to estimated losses of tens of millions of dollars. Active since at least 2019, it has impacted hundreds of thousands of online shoppers, especially those seeking niche or hard-to-find products.

The scam, revealed by HUMAN’s Satori Threat Intelligence and Research team, exploits known vulnerabilities, misconfigurations, or compromised admin credentials to insert malicious scripts into legitimate sites. These scripts create deceptive product listings that rank prominently in search engine results, a tactic known as SEO poisoning.

Clicking on these links redirects unsuspecting consumers to counterfeit stores under the attackers' control. “Phish n’ Ships is especially devious because it stole tens of millions of dollars from unsuspecting consumers hunting for hard-to-find items,” noted Gavin Reid, Chief Information Security Officer at HUMAN.

The malicious web stores replicate legitimate shopping experiences, complete with a checkout process that collects payment card details. However, no products are ever shipped despite payment, and consumers’ sensitive financial data is captured. According to the report by BleepingComputer, the campaign used multiple payment processors to rake in profits.

Adding to the complexity, the cybercriminals used Simplified Chinese in their internal tools, indicating possible links to actors operating from mainland China.

HUMAN and partners have since collaborated with payment processors and law enforcement, notifying them to disrupt the scheme. This joint effort led to the removal of fraudulent listings from search engines and the suspension of malicious payment accounts, yet the Phish n’ Ships operation still remains a persistent threat.

“Phish ‘n’ Ships underscores the value across the entire customer journey of a unified approach to digital fraud and abuse,” said Lindsay Kaye, Vice President of Threat Intelligence at HUMAN. Though authorities have made headway, the attackers will likely continue searching for new vulnerabilities.

Cybersecurity experts urge consumers to stay vigilant when shopping online, especially during the holiday season. Shoppers should verify URLs, scrutinize unfamiliar redirects, and report suspicious transactions promptly.

About the Author

Husain Parvez is a Cybersecurity Researcher and News Writer at vpnMentor, focusing on VPN reviews, detailed how-to guides, and hands-on tutorials. Husain is also a part of the vpnMentor Cybersecurity News bulletin and loves covering the latest events in cyberspace and data privacy.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Please enter a valid email address