Christmas Scams: How Smarter Hackers Target Businesses and Shoppers Alike

The usual gang of suspects: an email or text pretending to be from your favorite courier or marketplace, declaring a failed delivery, a customs fee you’ve got to pay, or a problem with your account. Instead of a reliable tracking portal, that link sends you to a page where phishers and malware creators hang out.

During the holidays, when everyone is waiting for multiple gifts, even seasoned users can be tricked into clicking. 

The impact on businesses increases when staff use corporate email addresses for shopping or click on fake delivery updates on company devices. A single compromised account can quickly lead to lateral movement across your Microsoft 365 tenant. 

As people tend to be more generous in December, attackers ramp up their Christmas phishing scams, pretending to come from well-known charities or urgent disaster relief funds. These emails often use emotional language and tight time limits to push users onto fake donation pages, and they feature familiar branding.   

These campaigns steal card details from individual donors and can also target businesses through bogus ‘corporate giving’ requests or fake sponsorship invoices. A good way to avoid scams is to verify the charity’s website directly and donate through their official channels instead of clicking on links found in emails.  

Business email compromise doesn’t take a break for the holidays. In fact, attackers often lean into seasonal themes, sending messages that appear to be from executives asking assistants or finance staff to urgently buy gift cards for clients or staff parties. The money is laundered through the cards, and the attacker disappears. 

These scams work because they mix authority, urgency and a plausible Christmas story. Clear internal processes for approvals, plus verification via a second channel such as Teams or phone, are the best antidote. 

Digital greeting cards are a nice gesture, but they’re also an easy cover for malicious links and payloads. Fake card notifications or “holiday photo collections” often hide malware inside attached archives or point to drive-by download sites. Once opened on a corporate machine, that festive screensaver can become the first stage of an intrusion. 

Modern email security can sandbox suspicious attachments and links, but user awareness still matters. If you are not expecting an email from a supplier, it is safer to verify it before opening. 

Attacker-in-the-middle phishing kits intercept login traffic between the victim and the real service, allowing the attacker to steal passwords, one-time codes and session cookies. At Christmas, these kits are wrapped inside fake shopping, courier or bonus-payment emails that coax users onto spoofed login pages. 

Once an attacker has gained access to a live session, they can bypass multi-factor authentication and access email content, cloud storage, and other connected services. From there, internal fraud or data theft is only a small step away. 

Hornetsecurity’s Cybersecurity Report highlights a worrying trend: TXT and DOC file attachments, long considered relatively harmless, are being abused as new malware delivery vehicles. During the holiday rush, fake invoices, order summaries and shipping documents using these formats are an easy way to smuggle code past overworked staff.  

If your filters are only dialled in for classic executable attachments, these newer formats can slip through. Sandboxing and content disarm-and-reconstruct (CDR) technology make it much harder for this vector to succeed. 

Every December, fake e-commerce sites that closely mimic real brands pop up, often boosted by malicious ads or search engine manipulation. They lure in unsuspecting customers with limited-time mega deals on popular gadgets, before collecting their card details and personal information and vanishing overnight.  

On social networks, attackers create fake profiles impersonating brands or influencers, promising huge Christmas giveaways or discount codes. To enter, victims are asked to follow a link, share personal data, or install a mobile app that quietly harvests credentials. 

Remind your staff that they should not use corporate email addresses or devices to register for social media promotions, as this is key to mitigating this risk. 

SMS-based attacks (smishing scams) during the holidays are rising alongside email scams. Fake delivery texts, bogus bank alerts, and “out of stock, click to re-confirm” messages often contain short, obfuscated links that are hard to inspect on a small screen. 

Once a victim has tapped on the link, mobile browsers and apps may automatically open login pages or prompt for card details. Encourage your employees to treat text messages with the same caution as emails and to access services via official apps or saved bookmarks. 

Attackers are increasingly abusing shared links in cloud services, such as SharePoint, OneDrive and Teams. A seemingly harmless link to an ‘updated Christmas rota’ or ‘holiday campaign assets’, for example, could actually point to a malicious file or a phishing portal hosted in a compromised tenant. 

As the link appears to come from a trusted colleague or partner, staff are more likely to grant access or sign in without thinking. It is therefore crucial to tighten external sharing policies and monitor access permissions. 

Free festive wallpapers, screensavers, browser extensions or games can hide far more than snowflakes and jingles. Attackers package loaders and remote-access tools inside seemingly innocent downloads, counting on users to bypass controls in the name of “just a bit of fun.” 

Once inside, those tools can be used to stage ransomware, steal browser-stored passwords, or move laterally to more sensitive systems. Application control and restricting local admin rights on endpoints significantly reduce this risk. 

Finally, attackers know that the fastest way into a well-defended enterprise is often through a smaller supplier. In December they step up targeted campaigns against payroll providers, marketing agencies and other third parties, hofaping to hijack genuine email threads and inject fraudulent payment details or malware. 

These supply-chain-themed Xmas Attack campaigns can be hard to spot because they abuse genuine relationships and ongoing projects. Essential checks include verifying changes to bank details and monitoring third-party accounts for anomalous behaviour.