Your item has sold! Avoiding scams targeting online sellers

March 3, 2025

When the subject of online security on online marketplaces comes up, it usually focused on risk towards buyers. However, sellers in these marketplaces are equally vulnerable to fraud schemes, not just in the general form of buyers dodging out of payment, but serious financial fraud attacks that lead to phishing, the loss of sensitive data, and potential asset theft. From the perspective of a threat actor, successful online sellers are more likely to have large volumes of available funds that they could target compared to buyers. Additionally, sellers are used to having frequent, unsolicited verification prompts related to their sales, which gives threat actors the perfect opportunity to use a classic phishing scam.

In a recently reported scam, an online seller related that they received a direct message impersonating the staff of the Reverb online marketplace. What appeared to be a link to verify payment details actually used percent encryption to disguise a redirect to an attacker-controlled domain impersonating the Reverb website. This website used social engineering through chat prompts to not only enter their credit card details, but also to “verify” their bank account details by providing the threat actor with their bank balance, letting the threat actor know what accounts will be most valuable for them to drain. Reverb is aware of the issue and is taking steps to tell users when they’re being redirected to a third-party domain, but the same tactic could easily be employed on other online marketplaces if they do not take similar steps.

Emails are of course also a major threat vector for cyberattacks against sellers. There have been multiple reported instances of sellers receiving fake chargeback notifications and giving prompts to “review” the details, leading either to the same kind of social engineering attacks as above, or potentially to the delivery of malware. Individuals or businesses engaged in selling products via an online business need to be aware of this potential attack vector, and to thoroughly review the policies of the marketplace against cyberattacks to ensure they are being sufficiently protected.

More from Blackwired

May 14, 2025

Using Blob URLs to Bypass SEGs and Evade Analysis

Hackers use Blob URIs to host phishing pages locally, bypassing detection and exfiltrating credentials undetected.

Read more
May 7, 2025

Claude AI Exploited to Operate 100+ Fake Political Personas in Global Influence Campaign

Claude AI was misused to run a propaganda network, showing new risks of AI in digital influence and fraud.

Read more
April 30, 2025

Ransomware groups test new business models to hit more victims, increase profits

Ransomware groups adapt with new models; DragonForce decentralizes tools, Anubis shifts to extortion over encryption.

Read more