For millions of shoppers, the anticipation surrounding Amazon’s Prime Big Deal Days on October 6 and 7 represents a key opportunity to snag bargains before the holiday season. However, for cybercriminals, this period signifies a flourishing harvest season, with preparations underway well in advance.
Recent studies underscore a worrisome trend in online security related to Amazon. KnowBe4’s Threat Lab reports a staggering 188% spike in Amazon impersonation attacks from late August to September. This mirrors findings from Check Point Research, which highlights a significant increase in newly registered domains associated with Amazon and Prime Day. The number of such domains soared from 905 in July to 1,284 in September, marking a 42% increase and a notable 37% uptick compared to 937 recorded in September 2025.
The objectives of these cybercriminals remain alarmingly familiar: account takeovers, credit card theft, and malware distribution. However, the sophistication, scale, and geographical targeting of these attacks have evolved and become more precise.
Infrastructure Development by Cybercriminals
According to Check Point, around 6.5% of Amazon-themed domains registered in September were identified as malicious or suspicious by their ThreatCloud platform—approximately one out of every sixteen new domains. KnowBe4 monitored over 700 newly registered Amazon-themed domains within a concentrated three-week period leading up to the event.
Among the domains flagged as potentially harmful between July and September are examples like amazonprime-support[.]com, primevideoamazon[.]com, and amazonprimeusa[.]com. Researchers have also discovered fake Amazon login pages specifically targeting users in countries such as Japan, Vietnam, and the UK. Such activity suggests a systematic and coordinated approach.
Check Point identified a particular cluster of related domains, termed the AmazonShopping/ShoppingOnAmazon Numbered Network, containing eleven domains, ten of which were malicious and designed to mimic the legitimate Amazon storefront and its checkout processes. Another category, the AmazonGlobal Numbered Domains, features five similarly constructed domains targeting international shoppers, all of which have been flagged as malicious. Researchers have also uncovered entire counterfeit Amazon storefronts in Germany and Japan, alongside sites targeting Amazon’s delivery partner program in India.
Advanced Evasion Techniques
Data from KnowBe4 indicates that cybercriminals are now heavily investing in strategies to bypass email defenses. Approximately 75% of the Amazon-themed attacks analyzed were polymorphic, consistently altering display names, subject lines, or sending domains to avoid detection. Furthermore, nearly two-thirds of these attacks employed technical obfuscation techniques, using hidden characters and zero-width spaces, while over 95% linked to counterfeit payment gateways or credential-harvesting sites that featured cloned logos and other deceptive elements.
The largest phishing campaigns, typically themed around account security alerts or delivery updates, averaged around 86 attacks each. For instance, one high-volume operation utilized fake warnings regarding ‘suspicious login activity’, rotating a mix of sender email accounts to mask detection signals.
Moreover, attackers have employed generative AI to customize phishing messages with localized content, significantly improving their effectiveness. In one campaign targeting UK and US inboxes, personalized deals were dynamically generated while the subject lines were rewritten to increase the likelihood of being opened. While these emails claimed to originate from Amazon, investigators traced the actual senders back to infrastructure associated with a legitimate multi-cryptocurrency wallet app that had been abused or spoofed for domain reputation.
The Localized Approach
Though many phishing campaigns use a large-scale approach, KnowBe4 observes that attackers are tailoring their tactics to local cultures and concerns:
- United Kingdom: Tactics often focus on delivery and parcel scams, with communications urging recipients to confirm their delivery addresses.
- United States: A significant 76% of attacks center on billing issues or membership renewals, preying on fears of losing Prime benefits.
- Germany: Focus here is predominantly on delivery-based scams, including a recent wave mimicking Japanese campaign tactics.
- France: About 90% of targeted attacks featured messages natively translated into French, enticing users with offers of ‘exclusive access’ and time-limited deals.
The Role of AI in Phishing Campaigns
Both KnowBe4 and Check Point underline the transformative impact of generative AI in facilitating such scams. With the ability to produce well-structured, localized phishing messages rapidly, as well as convincing replica websites, cybercriminals can eliminate the tell-tale grammar and spelling errors that have historically helped users spot scams.
Implications for Businesses
The threat landscape extends beyond consumers; financial services and payment infrastructures involved in processing Prime Day transactions are similarly at risk. Check Point reported an average of 2,650 attacks per organization per week in September—a 14% increase from August and an astonishing 66% rise year-over-year.
With the rise in attacks on consumer goods and services organizations, the need for retailers and payment providers to proactively identify and thwart malicious domains before they reach consumers has never been more critical.
Caution Is Key
Lucy Gee, Lead Threat Analyst at KnowBe4, emphasizes the importance of vigilance as Prime Big Deal Days approach, advising consumers to take a moment before clicking on links in emails that sound alarmist or too enticing. She urges shoppers to directly check their accounts through the official Amazon website or app to avoid falling victim to phishing schemes.
To bolster security, experts recommend the following precautions:
- Access Amazon directly through official channels, avoiding links in emails or texts.
- Verify sender details and URLs before clicking.
- Be cautious of pressure tactics, such as countdown timers or threats of account suspension.
- Enable multi-factor authentication to add an extra layer of security.
- Keep a close eye on transaction statements and promptly report any suspicious activity.
As malicious online activities continue to rise, the message from security researchers is clear: while the Prime Big Deal Days may offer only 48 hours of shopping frenzy, the repercussions of a single hasty click can linger far longer.