McAfee researchers have discovered a new version of the 16Shop phishing kit in use by hackers around the world. According to the latest research, there are now more than 200 URLs currently being used by hackers to collect login information from Amazon customers. The methodology the hackers are using is simple. The hackers craft an email that appears to come from Amazon that indicates a problem with the user’s account.

Ironically, most of the emails claim that an unauthorized login was attempted on the user’s account and the email recommends that the user log in immediately to check and make sure nothing has been tampered with.

The email “helpfully” includes a link that appears to point to an Amazon login page, but of course, it’s actually one of the aforementioned hacker-controlled URLs.  If a user enters their login credentials, they’re simply handing those details to the hackers. They can then log into the user’s account at their leisure, make any changes they like, and order products or steal data at will.

16Shop is a sophisticated product that has been used in a variety of ways.  A previous variant was discovered in late 2018, which targeted Apple users via emails that contained a PDF attachment.  The PDF was poisoned, of course. If the links it contained were clicked on, they would direct the recipient of the email to a URL controlled by the hackers. That URL would ask for the recipient’s Apple account information, including payment card details.

These kinds of attacks are notoriously difficult to stop.  Vigilance and mindfulness are the keys to keep from being taken in.  A good policy to adopt is simply this:  Any time you get an email that appears to come from a company, don’t click the link.  Open a browser tab yourself and manually type the address in.