Were you among the hundreds of millions of people flocking to the movie theater to see Barbie or Oppenheimer this summer? Both movies dominated the box office bringing in over a billion USD in combined revenue. Even if you did not see either of the films, you probably noticed the groups of people out in public wearing all pink or dressed straight from the 1920s. Despite the writers’ and actors’ strike and superhero movie flops at the box office, Barbie and Oppenheimer still caught great success. But production studios might not be the only ones that benefit.
Malicious actors continue to find new ways to exploit unsuspecting victims among a growing attack surface. Movies, characters, and even quotes can be used to create spoof domains weaponized for malicious activity. Here are ken warning signs to look out for (anywhere else they’d be a ten):
- Virtual Events: You may have attended an event, like an early screening or a group outing, that you discovered online. Malicious actors can exploit that excitement by creating fake domains and offering virtual tickets to non-existent events to collect credit card information, emails, and even personally identifiable information (PII) like your address.
- References: Movies will try to fill your head with an ear worm. There’s going to be THAT reference with the sole goal of being quoted endlessly. Malicious actors may also tail that reference and use a unique string related to it as the basis for a malicious domain. In the case of the Barbie movie we found several strings in Iris Detect that referenced the incredibly quotable “Mojo Dojo Casa House.” For all the investigators that want to stay ahead of these trends, Domain Blooms enable you to identify new and trending themes in domain names being registered, and highlight which ones threat actors are potentially targeting for their malicious campaigns. You can see the full list of domains related to Barbie on GitHub.
- Theater Information Sites: Attackers could create domains posing as official theater websites, providing misinformation to potential customers and even suppliers. If you do any business with movie theater companies, setting a monitor for Cinemark, AMC, and Regal could be beneficial in identifying malicious domains before they’re used against you.
- Sequel Spoilers: The success of Barbie has made Mattel eager to promise a movie for what seems like every one of their properties, from Uno to Rock-Em-Sock-Em Robots. Einstein’s cameo in Oppenheimer was reminiscent of one Marvel would use to tease an upcoming spinoff. Crafty cybercriminals might set up domains promising exclusive first looks for highly anticipated movie sequels, enticing viewers to click on fraudulent links and unknowingly disclose sensitive information.
- Fan Clubs: Even if you’re the biggest fan in the world, be very careful about to whom you give that information. Malicious actors could pose as fan clubs in an attempt to carry out social engineering attacks and obtain more information from you than just what kind of Barbie you are.
- Merchandise: If you felt like you saw Barbie everywhere you went, that was by design. Warner Brothers and Mattel spent over 100 million USD marketing this movie. The hope by Mattel may be that nostalgia and Barbie mania causes more people to buy Barbies and “I am Kenough” hoodies, but malicious actors can also take advantage of this hysteria by selling counterfeit products or using the promise of merchandise to get PII out of fans. Using our risk score to predict how likely a domain is to be malicious can be a great way at discerning if you’re getting more than what you paid for.
- Ticket Scams: Barbie and Oppeheimer were so popular that it was incredibly difficult to get tickets opening night (and in some places, it’s still hard to get tickets at your desired time). Many threat actors are taking advantage of this by launching fraudulent campaigns that sell fake tickets to consumers. Don’t let this digital trojan horse mesmerize you like the horse iconography in the Barbie movie did to Ken. Timely domain discovery can help thwart these fraudulent campaigns before they are launched.
- “Exclusive” Access: Much like the ticket scams discussed above, there are several malicious domains, like premiere-movies.com, theatral-premieres.online, and moviespremiere.xyz, that have surfaced impersonating official movie premieres, offering “exclusive access” to unreleased content as a means of tricking users into revealing personal data. Predictive risk scoring, with full-Internet context, lets you know which threats are critical and how to stop them in their tracks.
- Streaming: If you don’t want to pay the ticket price, it may be tempting to sail the high seas and search for a means to pirate the newest released movie. Not only is there a legal risk to pirating films, but cybercriminals can also take advantage of this desire with the promise of free streaming of newly released movies, enticing users to visit malicious websites or download malware.
- Contests and Sweepstakes: This one can be difficult to spot because many movie companies have been offering sweepstakes and contests associated with the release of their feature film. Unfortunately, it’s just as easy for a malicious actor to spoof one of these contests in an effort to obtain personally identifiable information. Implicit trust often leads to unintended and unauthorized access to resources, with consequent security problems. Give thought to if the contest is truly worth pursuing, and what could be at risk if you comply with the requirements before taking a chance on giving away your personal information.
When the next blockbuster comes to a theater near you, remain vigilant about associated content online. Barbie and Oppenheimer saw an enormous payoff in their marketing campaigns, meaning more content will likely follow to promote future movies. Expect threat actors to follow the money and these efforts with campaigns of their own. Stay ahead of the threats and beach the adversaries by knowing if and when malicious domains and infrastructure are spoofing your assets before they cause damage.
