- NordVPN’s researchers saw more than 100,000 malicious websites with an Amazon theme
- Besides phishing for credentials, crooks are tricking people into making fraudulent purchases
- Consumers are advised caution during Prime Day
Hackers have set up thousands of fake websites, using them to steal login credentials, trick people into downloading malwareor make fraudulent purchases ahead of this year’s Amazon Prime Day.
A new report from NordVPN’s Threat Protection Pro team has urged consumers to be extra vigilant, claiming to have observed more than 120,000 malware, phishing, and scam websites propped up in the last two months, spoofing Amazon.
Of that number, there were 92,000 phishing sites, 21,000 malware distribution sites, and 11,000 fake goods sites.
Perfect storms
“Major shopping events like Prime Day create perfect storms for cybercriminals. Scammers know that shoppers’ excitement and urgency around limited-time deals make them more susceptible to clicking on malicious links or sharing personal information without proper verification,” Marijus Briedis, NordVPN’s CTO said.
“People should maintain good cyber hygiene even when looking for the best deals.”
While stealing login credentials remains a key goal for many fraudsters, one thing is growing increasingly popular – tricking people into making unauthorized payments. Apparently, this rose from 28% in April, to 38% today, and is “the highest reported objective.”
Events such as Amazon Prime Day, Black Friday, or Cyber Monday, remain key dates when cybercriminals ramp up their activity.
Amazon Prime Day is a major annual shopping event, during which the retail behemoth offers exclusive deals and discounts only for Prime members. It typically runs for two days, but this year, it will be four days long.
While this could be great for consumers, it’s even better for scammers who will definitely look to exploit the change, the researchers warned.
During Amazon’s Big Spring Sale week, which took place between March 31 and April 7, 2025, malicious activity “exploded”, NordVPN said, comparing the data to the week prior.
“Malware websites surged by 1,661%, phishing sites increased by 1,294%, and scam websites skyrocketed by 8,325%,” it was said.
Spotting a fake website can be tricky sometimes, but often there are giveaways – in particular, keep an eye out for obvious spelling mistakes in URLs or headlines – “Amazom.com” for example. And remember, a good rule of thumb is always that if a deal looks to good to be true, there’s a decent chance it is.
If you’re concerned you may have been caught by a fake site, don’t worry – there are a number of methods to find out. HaveIBeenPwned? is probably the best resource only to check if your details have been affected, offering a run-down of every big cyber incident of the past few years.
You should also ensure your devices have the best antivirus tools on offer to keep you protected, alongside the best firewall and best endpoint protection software.