The 2025 holiday season has unleashed an unprecedented wave of cyber threats, with attackers deploying industrialized infrastructure to exploit the global surge in online commerce.

This year’s threat landscape is characterized by a calculated expansion of deceptive digital assets, where criminals leverage automated tools to scale their operations across multiple merchant categories.

The primary vector for these campaigns involves the mass creation of look-alike websites designed to mimic legitimate retailers and capture sensitive consumer data during peak shopping periods.

One of the most significant indicators of this pre-holiday offensive is the registration of over 18,000 holiday-themed domains in the past three months alone.

Targeting high-traffic keywords such as “Christmas,” “Black Friday,” and “Flash Sale,” these domains serve as the backbone for phishing schemes and fraudulent storefronts.

Many of these sites mimic household names with slight URL variations, making them nearly indistinguishable to hurried shoppers.

While a portion of these domains remain inactive to evade early detection, hundreds have already been weaponized to host gift card scams and payment-harvesting pages.

Fortinet security analysts identified this extensive network of malicious infrastructure, noting that the campaign’s scale facilitates effective SEO poisoning.

By artificially inflating the search rankings of these malicious URLs, attackers ensure their fraudulent sites appear alongside legitimate results during peak traffic.

The researchers further highlighted a disturbing rise in credential theft, with over 1.57 million login accounts from major e-commerce sites currently circulating in underground markets.

These “stealer logs” contain browser-stored passwords, cookies, and session tokens, enabling rapid account takeovers that bypass traditional login defenses (Figure 1: Domain Registration Trends).

Technical Exploitation of Platform Vulnerabilities

The sophistication of these attacks is most evident in the targeted exploitation of critical e-commerce vulnerabilities. Attackers are actively leveraging CVE-2025-54236, a critical flaw in Adobe Magento caused by improper input validation.

This vulnerability allows threat actors to execute a remote code execution (RCE) attack, effectively bypassing authentication layers to achieve session takeover.

By injecting malicious payloads into unvalidated input fields, attackers gain administrative access, enabling them to install persistent backdoors or JavaScript-based web skimmers directly onto checkout pages.

Additionally, the exploitation of CVE-2025-61882 in Oracle E-Business Suite permits unauthenticated RCE, allowing ransomware groups to paralyze backend inventory systems.

These technical incursions are executed via automated scripts that continuously probe for unpatched systems, transforming a single vulnerability into a gateway for massive data exfiltration.

This systematic exploitation underscores the critical need for merchants to apply patches immediately.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Registered 18,000 Holiday-Themed Domains Targeting ‘Christmas,’ ‘Black Friday,’ and ‘Flash Sale’ appeared first on Cyber Security News.

The Handala hacker group has launched a targeted campaign against Israeli high-tech and aerospace professionals, marking a concerning shift in geopolitically motivated cyber operations.

The group recently published a list of individuals working in these critical sectors, accompanied by hostile descriptions that falsely label them as criminals.

This campaign represents a significant escalation from traditional propaganda activities to active doxxing and intelligence gathering against private-sector employees.

The attack centers on the public exposure of personal and professional information belonging to Israeli specialists.

Handala released the dataset through their dark web platform and offered financial rewards to anyone willing to provide additional information about the targeted individuals.

This bounty-style approach creates a crowdsourced intelligence collection mechanism that amplifies the threat beyond the initial data leak and endangers ordinary professionals.

Trustwave security researchers identified this activity during ongoing dark web monitoring operations. Their analysis revealed that the published dataset relies heavily on information scraped from LinkedIn profiles.

However, the researchers noted several inconsistencies within the data, including individuals who left their listed companies years ago, employees in non-sensitive roles, and profiles with no verifiable connection to the high-tech sector at all.

Data Manipulation and Weaponization Techniques

The technical analysis of Handala’s methods shows a combination of automated data scraping and manual data manipulation.

Several profiles could not be traced or verified, suggesting the group may be supplementing legitimate LinkedIn data with fabricated entries or information from unverifiable sources.

This approach allows them to inflate their target list while maintaining a veneer of authenticity that makes the campaign appear more comprehensive.

The indiscriminate nature of this data collection demonstrates how publicly available information can be weaponized at scale.

By framing ordinary workers as criminal targets and pairing this with financial incentives for additional intelligence, Handala has created a dangerous mechanism that poses direct risks to the privacy, safety, and professional reputations of legitimate employees.

Security experts recommend heightened personal data hygiene, continuous monitoring for identity-related threats, and organizational awareness programs to protect against similar targeting campaigns in the future.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Handala Hacker Group Attacking Israeli High-Tech and Aerospace Professionals appeared first on Cyber Security News.