Inside Intelligence Center: Financially Motivated Chinese Threat Actor SilkSpecter Targeting Black Friday Shoppers

Executive Summary

In early October 2024, EclecticIQ analysts uncovered a phishing campaign that targets e-commerce shoppers in Europe and USA, looking for Black Friday discounts. Analysts assess with high confidence that it was very likely orchestrated by a Chinese financially motivated threat actor, analysts dubbed as SilkSpecter. The campaign leveraged the heightened online shopping activity in November, the peak season for Black Friday discounts. The threat actor used fake discounted products as phishing lures to deceive victims into providing their Cardholder Data (CHD) [1] and Sensitive Authentication Data (SAD) [2] and Personally Identifiable Information (PII).

Figure 1 - EclecticIQ Intelligence Center graph view for SilkSpecter activities.
(click on the image to enlarge).

Threat actor SilkSpecter targeted victims' Cardholder Data (CHD) by leveraging the legitimate payment processor Stripe [3]. This tactic allowed genuine transactions to be completed while covertly exfiltrating sensitive CHD to a server controlled by the attackers. SilkSpecter enhanced the phishing site’s credibility by using Google Translate to dynamically adjust the website's language based on each victim’s IP location, making it appear more convincing to an international audience.

EclecticIQ analysts observed that prior to November 2024, SilkSpecter had launched similar phishing campaigns, all linked to a Chinese Software as a Service (SaaS) platform named oemapps [4]. Analysts assess with high confidence that oemapps very likely enables SilkSpecter to quickly create convincing fake e-commerce sites targeting unsuspecting users. These phishing domains predominantly use the .top, .shop, .store, and .vip top-level domains (TLDs), often typosquatting legitimate e-commerce organizations' domain names to deceive victims.

Tracking Black Friday Themed Phishing Domains with EclecticIQ Intelligence Center

Analysts used the EclecticIQ Intelligence Center to uncover a pattern among Black Friday-themed phishing domains that was very likely linked to the SilkSpecter threat actor

Figure 2 – Uncovering the pattern among Black Friday-themed phishing pages.

Each phishing page included "trusttollsvg," a deceptive icon designed to give the appearance of a trusted site, and a "/homeapi/collect" endpoint that informed attackers whenever a victim clicked or opened the URL - tracking the phishing campaign’s success in real-time [5]. These distinct elements became crucial indicators, enabling analysts to identify additional discount-themed phishing domains associated with the SilkSpecter activity cluster.

Analyzing the SilkSpecter’s Phishing Kit 

SilkSpecter’s phishing pages lured victims with a convincing Black Friday discount theme, often promoting an "80% off" offer to entice e-commerce shoppers into believing they were accessing exclusive deals. Once victims landed on the page, the phishing kit deployed several website trackers, including OpenReplay [6], TikTok Pixel [7], and Meta Pixel [8], to monitor the effectiveness of the attacks by collecting detailed activity logs from each visitor.

Figure 3 - Black Friday-themed phishing page with fake “Trusted Store” icon.

The phishing kit also captured key browser metadata, such as IP addresses, geolocation, browser type, and OS details. Using this information, the page is dynamically translated into the victim's language through Google Translate APIs, further increasing its authenticity.  
 

Figure 4 - Victim's browser metadata sent over another remote server likely managed by the attacker

Victims entering their Personally Identifiable Information (PII) and banking details (CHD and SAD) for a fake discounted item submitted their information through Stripe, a legitimate payment service that SilkSpecter abused to process real transactions. After a payment was made, the phishing kit exfiltrated all entered details to an attacker-controlled server. 

Figure 5 - Payment prompt screen on phishing page that uses Stripe

Victims were also prompted to enter their phone numbers before completing their purchases. EclecticIQ analysts assess with medium confidence that this information could likely be leveraged in a second stage of the attack if SilkSpecter chooses to exploit the compromised credit or debit card details for financial fraud. The phone numbers could enable attackers to conduct vishing (voice phishing) or smishing (SMS phishing) attacks, deceiving victims into providing additional sensitive information, such as 2FA codes, personal identification details, or even account credentials. 

By impersonating trusted entities, such as financial institutions or well-known e-commerce platforms, SilkSpecter could very likely circumvent security barriers, gain unauthorized access to victim's accounts, and initiate fraudulent transactions. After the victim initiates a payment request over Stripe´s APIs on the phishing website, the site covertly records the entire session and transmits the banking details to an external server hosted at longnr[.]com/payment/event-log[.]php. These additional requests, as seen in the intercepted traffic, indicate that the site is not only processing the payment through legitimate-looking means but is also capturing sensitive information, including card details, and relaying them to a separate server controlled by the attacker. This technique highlights how the phishing site is abusing legitimate APIs while simultaneously gathering and exfiltrating critical financial information.
 

Figure 6 - Payment details exfiltrated over attacker controlled remote domain.

Analysts assess with medium confidence that SilkSpecter likely distributed these phishing URLs through social media accounts and search engine optimization (SEO) poisoning, leveraging a Black Friday discount theme as social engineering bait to deceive unsuspecting online shoppers.

Attribution to Chinese Threat Actor SilkSpecter

EclecticIQ analysts assess with high confidence that SilkSpecter is very likely a Chinese threat actor. This attribution is based on multiple indicators observed across several phishing campaigns:

Language Indicators:

•    Each phishing page contained JavaScript code with Mandarin comments, suggesting the involvement of a Chinese-speaking developer.
•    The "zh-CN" language tag in the HTML code strongly suggests that the phishing sites were developed by Chinese-speaking individuals.