Holiday Cyber Attacks: Tips & Trends

This report documents holiday-themed malicious activity: credential- and payment-stealing phishing pages (Microsoft, USPS), obfuscated JavaScript card-skimmers injected into e-commerce checkout pages that detect debugging and exfiltrate Base64-encoded payment data to attacker domains, and fraudulent shopping sites/Google Forms scams collecting Pix or card details; actors commonly use newly registered domains, mobile-only redirects, and legitimate services to evade detection.