The current coronavirus pandemic has resulted in the closure of many pubs, restaurants, and brick-and-mortar retail stores. Many purchases that would previously have been made in person now take place online. In research commissioned by Visa, 89% of Britons have shopped online since the UK’s lockdown restrictions began, with 31% buying items online for the first time during this period. This increase in online shopping activity benefits criminal groups in that: smaller businesses newly reliant on online transactions provide attackers with a stream of inadequately-defended shopping sites to exploit, and buyers are far more likely to be driven to these compromised shops or to fake shops compared to before the pandemic.

JavaScript skimmers run on compromised shopping sites. When shoppers enter their payment details, the skimmer secretly sends a copy to the attacker – potentially even if the customer does not complete the transaction. Even the most careful of users can be victims of these attacks, as they appear on compromised but otherwise well-intentioned shops with no visual indication of their presence.

Fake shops are another threat. Shoppers seeking bargains may unknowingly find themselves on a fake shop which claims to offers the products they want at a highly discounted price, but the victim will subsequently only receive counterfeit goods, no goods at all, or have the transaction aborted after entering credentials which is equivalent to a phishing attack.

Fake shops also take advantage of the pandemic by offering goods in high demand due to coronavirus, such as N95 masks. The FBI has released a Public Service Announcement about an increase in online shopping scams involving the sale of counterfeit healthcare products such as Personal Protective Equipment (PPE). To date, Netcraft has blocked over a thousand such coronavirus-themed fake shops, 80,000 other fake shops selling all sorts of counterfeit goods, and around 3,500 compromised shops hosting JavaScript skimmers.

The Netcraft browser extension and mobile apps provide protection against fake shops as well as legitimate shopping sites that have been compromised with JavaScript skimmers. When an extension or app user visits one of these dangerous shops, Netcraft will block access to the shop and alert them:

Protection against Shopping Site Skimmers, along with other malicious JavaScript, was added to the Netcraft browser extension in August last year. Since then, whenever an extension user visits a site that Netcraft has blocked for containing a skimmer, they are redirected to a block screen. The Netcraft Android and iOS apps also have this feature.

Additionally, the Netcraft browser extension blocks shopping sites which use resources known to be part of skimming infrastructure – even if Netcraft has not blocked the shop. Whenever the extension detects a request being sent to a URL associated with skimming activity, it blocks the request and reports the compromised shopping site to us.

In this manner, Netcraft is able to receive a continuous stream of new compromised shopping sites automatically as the extension user community shops. The relationship between Netcraft and our community of browser extension users is symbiotic: as our users shop, we protect them from skimmers, and we use the information about any compromised shopping sites they find to automatically protect the rest of the community. Users can choose to opt-out of reporting these sites to Netcraft if they prefer.

The Netcraft Browser Extension is available to download for free on Chrome, Firefox, Opera, and Edge.

Select your browser to download the Netcraft Browser Extension now:

You can also be alerted on your mobile device if you browse to a dangerous shopping site that Netcraft has blocked, including a fake shop or a shopping site that has been compromised with a JavaScript skimmer. The Netcraft app for Android and iOS is available to download from the following app stores: