Black Friday shopping is stressful enough under normal circumstances. This year, it is also getting significantly more dangerous. Cybersecurity researchers have just uncovered a highly automated, AI-driven phishing campaign designed to hijack the financial accounts of unsuspecting holiday shoppers. The primary targets are people looking to purchase digital gift cards through PayPal.
Cybersecurity firm NetShield Intel flagged the threat after detecting a massive spike in suspicious domain registrations mimicking PayPal’s legitimate digital gift card portal. The campaign uses advanced artificial intelligence to craft hyper-realistic emails and text messages, completely bypassing traditional spam filters and making the scam nearly impossible for the average consumer to spot.
The AI Behind the Trap
Historically, phishing campaigns have had telling giveaways. Poor grammar, awkward phrasing, and misaligned logos used to be dead giveaways for cybercriminals. Generative AI has changed all of that.
According to researchers, the bad actors behind this campaign are using customized large language models to generate highly personalized, flawless copy. The emails adapt in real-time to match the language, tone, and formatting of legitimate PayPal promotional material. They pitch highly enticing, limited-time discounts on popular digital gift cards for brands like Apple, Amazon, and PlayStation.
“The emails are virtually flawless,” says Marcus Thorne, principal threat analyst at NetShield Intel. “We are no longer looking at easily spotted spam. These messages look, feel, and read exactly like authentic communication from PayPal. The psychological trigger of a ‘pre-Black Friday sale’ is incredibly effective at making people act first and think later.”
A Dynamic Two-Factor Bypass
What makes this campaign particularly dangerous is what happens after a victim clicks the link. Instead of a static clone of a website, the attackers use an AI-driven, interactive phishing kit.
When a victim attempts to buy a discounted gift card, they are redirected to a spoofed PayPal checkout page. As soon as they enter their login credentials, the phishing kit instantly analyzes the data. If the victim has two-factor authentication (2FA) enabled on their real account, the AI script detects this in real-time. It immediately generates a dynamic pop-up on the fake site, prompting the user to enter their one-time passcode.
While the user thinks they are securing their transaction, the system automatically feeds the code directly to the hackers, allowing them to take over the real account in seconds. The automated system then redirects the user to a fake confirmation page to delay suspicion while the scammers drain the account or use linked credit cards to buy high-value goods.
The Scale of the Attack
NetShield Intel reports that over 45,000 fraudulent domains have been registered in relation to this campaign over the last three weeks alone. These domains use clever typosquatting techniques, employing subtle misspellings of PayPal and gift card-related terms that look convincing on mobile browser address bars.
Estimates suggest that thousands of shoppers have already fallen victim to the scam. Financial losses range from $50 for individual gift card amounts to thousands of dollars when hackers gain full access to linked bank accounts.
How to Stay Safe This Holiday Season
As the holiday shopping season ramps up, cybersecurity experts are urging extreme caution when buying digital gift cards. Traditional warning signs may no longer be reliable, but shoppers can protect themselves by adopting stricter security habits.
- Never trust links in unsolicited messages: If you receive an email or text offering a massive discount on gift cards, do not click the link. Open your browser and navigate directly to the official PayPal website or app.
- Check the full URL: Examine the address bar carefully on your browser. Scammers often use subtle tricks, like replacing the letter ‘l’ with the number ‘1’ or using complex subdomains to hide the true source.
- Switch to Passkeys: Passkeys are significantly more secure than passwords and are highly resistant to phishing, as they verify the actual website identity before allowing a login.
- Monitor account activity: Keep a close eye on your bank statements and PayPal transaction history during the holidays. Set up instant push notifications for all transactions to catch unauthorized activity immediately.
As cybercriminals continue to weaponize artificial intelligence, the burden of security increasingly falls on consumer vigilance. This Black Friday, if a digital gift card deal looks too good to be true, it almost certainly is.
About the Author
