Fake advent calendar stores share one template, fake reviews and AI images to sell unlicensed merchandise
Malwarebytes examined several single-product advent calendar stores (a Legend of Zelda music calendar, a Michael Jackson calendar, a Lord of the Rings figure calendar, Harry Potter plant pots and a Metallica calendar) that share one website template, fake urgency cues and unlicensed character branding. Their store-added reviews, "verified buyer" badges and countdowns are not connected to any real sales data. The same pattern appears in stores selling fishing lures, squishy toys, charm bracelets and jumpers. The researchers found no licensing information, no business address or phone number, and a TikTok account that promotes a claimed Walmart partnership they could not confirm. The article says the evidence points to a shared sales playbook rather than a confirmed single owner, and it found no evidence of card-data theft; the risks it supports are misleading sales claims and paying for goods that never arrive or differ from the listing.
Detalhes técnicos
- The Zelda listing contradicts itself: it describes an offline player with no Wi-Fi or app, yet says the discs work with Spotify, Apple Music and YouTube. The researchers infer that the chip stores a link to a track, which is how the legitimate product works, and that the offline speaker claim was added on top of it.
- The stores share a commercial theme version and an internal fingerprint showing their theme files are copies, and they block right-click and developer tools.
- One store's theme is still named after an export file whose name contains the web address of another store in the group. Leftover text from a previous shop includes a costume warranty and a placeholder discount banner.
- Theme files are timestamped from mid-July to the second week of September. Most merchant accounts are registered in Romania, prices are in dollars, and checkout runs through Shopify.
- Product images from two stores carry an AI-generated content watermark that a provenance checker linked to OpenAI tools. Across three stores the filenames follow the same automated naming pattern.
- The TikTok videos show retail scenes that do not appear to be real. The article says this suggests one operator or a closely connected group, without establishing who that is.
Remediação
- Treat endless urgency (timers that reset, sales that always end today, permanent low-stock notices) as a warning, not as proof of a deal.
- Check that the product exists and how the real version works. Search the brand name separately from the link, and reverse-image search the photos.
- Look for a postal address, company registration and a working phone number, and check the spelling on the listing and the packaging.
- Be skeptical of partnership claims in videos until the retailer confirms them.
- Pay with a card or payment service that offers buyer protection, and be wary of paid add-ons such as shipping protection or queue-skip fees.
Linha do tempo
-
Fake advent calendar stores share one template, fake reviews and AI images to sell unlicensed merchandise
ler a análise desta fonte ocultar
Malwarebytes examined several single-product advent calendar stores (a Legend of Zelda music calendar, a Michael Jackson calendar, a Lord of the Rings figure calendar, Harry Potter plant pots and a Metallica calendar) that share one website template, fake urgency cues and unlicensed character branding. Their store-added reviews, "verified buyer" badges and countdowns are not connected to any real sales data. The same pattern appears in stores selling fishing lures, squishy toys, charm bracelets and jumpers. The researchers found no licensing information, no business address or phone number, and a TikTok account that promotes a claimed Walmart partnership they could not confirm. The article says the evidence points to a shared sales playbook rather than a confirmed single owner, and it found no evidence of card-data theft; the risks it supports are misleading sales claims and paying for goods that never arrive or differ from the listing.
Technical Details
- The Zelda listing contradicts itself: it describes an offline player with no Wi-Fi or app, yet says the discs work with Spotify, Apple Music and YouTube. The researchers infer that the chip stores a link to a track, which is how the legitimate product works, and that the offline speaker claim was added on top of it.
- The stores share a commercial theme version and an internal fingerprint showing their theme files are copies, and they block right-click and developer tools.
- One store's theme is still named after an export file whose name contains the web address of another store in the group. Leftover text from a previous shop includes a costume warranty and a placeholder discount banner.
- Theme files are timestamped from mid-July to the second week of September. Most merchant accounts are registered in Romania, prices are in dollars, and checkout runs through Shopify.
- Product images from two stores carry an AI-generated content watermark that a provenance checker linked to OpenAI tools. Across three stores the filenames follow the same automated naming pattern.
- The TikTok videos show retail scenes that do not appear to be real. The article says this suggests one operator or a closely connected group, without establishing who that is.
Remediation
- Treat endless urgency (timers that reset, sales that always end today, permanent low-stock notices) as a warning, not as proof of a deal.
- Check that the product exists and how the real version works. Search the brand name separately from the link, and reverse-image search the photos.
- Look for a postal address, company registration and a working phone number, and check the spelling on the listing and the packaging.
- Be skeptical of partnership claims in videos until the retailer confirms them.
- Pay with a card or payment service that offers buyer protection, and be wary of paid add-ons such as shipping protection or queue-skip fees.