AI-powered fake Black Friday stores surge 110% in holiday scams
Cybercriminals used Large Language Models to generate convincing product descriptions and content for thousands of fraudulent online stores during Black Friday 2024, with a 110% increase in fake stores detected from August to October. The LLMs helped threat actors scale operations by rewriting scraped content from legitimate retailers while avoiding plagiarism detection and improving search rankings.
What happened
Cybercriminals used Large Language Models to generate product descriptions and content for fraudulent online shopping sites targeting Black Friday shoppers. The LLMs were used to rewrite content scraped from legitimate platforms such as Amazon.com to mimic the style and tone of trusted retailers, with text refined to avoid plagiarism detection and improve search engine visibility.
Netcraft researchers identified a 110% increase in fake stores between August and October 2024, with tens of thousands hosted on SHOPYY, a Chinese e-commerce platform. More than 9,000 new and unique fake store domains were detected between November 18–21, with more than 66% of SHOPYY-powered sites identified as fake stores.
Reported impact
The use of LLMs has made fake store operations more accessible, affordable and effective for threat actors, allowing cybercriminals to launch and manage large-scale campaigns with minimal human oversight. The fraudulent sites generated polished, convincing product descriptions that enhanced their visibility in search rankings and appeal to potential victims.
Index analysis
Activity was primarily attributed to threat actors likely operating from China and primarily targeting U.S. shoppers. The growth in fake stores represents an all-time high, with each fraudulent domain carrying a registration cost of $1 or more.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.