China-Linked Hackers Are Spoofing Big-Name Retail Sites — Here’s What You Need to Know

David Bigger
Jul 5
3 min read

If it looks like Apple, Nordstrom, or Wayfair… it might just be a scam.

Security researchers are sounding the alarm on a large-scale phishing campaign tied to threat actors out of China, targeting everyday shoppers through fake retail websites designed to steal payment information. If you’ve been shopping online lately—and let’s face it, who hasn’t—you could’ve stumbled across one of these.

What’s Happening?

According to reports from cybersecurity teams like Silent Push and publications including The Record and BleepingComputer, hackers have built thousands of fake retail websites impersonating trusted brands. We’re talking Apple, PayPal, Nordstrom, Michael Kors, Harbor Freight, Wayfair, Bath & Body Works, even The North Face.

The trick? These sites look nearly identical to the real deal. They scrape product listings, use authentic logos, and in some cases, even integrate legitimate payment widgets like Google Pay or Stripe. To the average person, or honestly even to seasoned online shoppers, these sites can look convincing enough to lower your guard.

But here’s the kicker — your payment details go straight to the attackers. You’ll never get the product, but they’ll get your card number, personal information, and often your phone number too.

Why Should You Care?

This isn’t your typical fly-by-night scam. The scale and sophistication here are concerning:

4,000+ fake domains discovered tied to one operation, known by some researchers as “SilkSpecter”
Sites often target English and Spanish speakers, widening their net globally
Many use “.shop” or “.store” domains, but not always — attackers adapt quickly
After stealing payment details, they may follow up with fake calls or texts trying to phish further information, bypass multi-factor authentication, or commit identity theft

Researchers even found technical fingerprints in the code linking these sites to Chinese infrastructure. Some campaigns were originally focused on events like Mexico’s “Hot Sale” but have since expanded worldwide.

Breaking Down the Technical Side

Think of these fake sites like a movie set: the front of the building looks like a real store, complete with signs and shiny windows. But when you walk inside, it’s just plywood and props — no real merchandise, just a trap.

Technically speaking, attackers:

Clone or closely mimic real retail websites
Use familiar payment buttons to lull you into confidence
Often register domains that sound almost identical to real brands (think “nordsttom.shop” or “paypa1.store”) *for those of you studying, you’re right, that’s ‘Typosquatting’
Collect your credit card, address, phone number — sometimes even push fake receipts to seem legitimate

Behind the scenes, your information is funneled back to criminal servers, often hosted in regions with minimal oversight, making take downs harder for law enforcement.

How to Protect Yourself

Spotting these scams isn’t always easy, but there are a few habits that can keep you safer:

Stick to official websites: Type the URL directly or use trusted bookmarks. Don’t rely on ads or random search results.
Look at the domain: Watch for slight misspellings or weird endings like “.shop” or “.store” when the official brand doesn’t use them.
Use payment protections: Credit cards often have better fraud protection than debit cards. Services like PayPal (used correctly) add another layer.
Stay skeptical of deals that seem too good to be true: A $40 iPhone or $10 designer purse? Probably bait.
Enable alerts: Get notifications from your bank or credit card for purchases — the sooner you catch fraud, the better.

Final Thoughts

Online shopping’s convenient, but it’s a playground for criminals too. This campaign shows how attackers constantly evolve — leveraging real payment tools, designing convincing sites, and targeting global consumers with slick tactics.

The good news? Awareness is your best defense. Share this with family, friends, or that co-worker who always falls for “free gift card” emails. The more people who know what to look for, the harder it becomes for these scams to succeed.

Stay safe out there — and double-check that checkout page.