Back Scworld

Researchers identify AliExpress

Scworld • September 25, 2026

According to Infosecurity Magazine, security researchers have uncovered a sophisticated phishing campaign that utilized 10 newly registered domains designed to mimic AliExpress, a popular online retail platform.

EfficientIP Research Labs identified potential .cyou domains on June 9 that were later registered and began resolving to IP addresses on July 2. These domains, each following a pattern of one digit and five lowercase letters, were used as entry points to a fake AliExpress phishing site. The domains were designed to be disposable, with each redirecting visitors through a tracking layer that allowed operators to swap out exposed domains without rebuilding the campaign. This tactic circumvents reputation-based security controls, as the domains have little history.

The campaign's final destination was a site using a zero in place of the "o" in "shop," promoting a browser extension styled after a legitimate shopping assistant. Visitors risked credential and payment theft, as well as exposure of browsing activity. The tracking parameters could also generate affiliate revenue for the operator. While the research did not report specific victims or losses, it highlighted the potential harms and advised blocking the identified domains and IP addresses.

Source: Infosecurity Magazine

SC Staff September 25, 2026

SC Staff September 24, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AliExpress Phishing Campaign Exposed with Early DNS Detection EfficientIP Research Labs identified ten .cyou domains linked to an AliExpress phishing campaign before their registration on June 9, 2026. The domains became active on July 2, directing users to a fraudulent AliExpress-themed site that promoted a malicious browser extension. The campaign utilized a phishing redirect chain and familiar branding to deceive users, posing risks of credential theft and payment fraud. The domains followed a specific naming pattern and shared infrastructure, which allowed for early detection through DNS intelligence. This early identification provided security teams with a crucial opportunity to mitigate potential impacts before the domains were classified as malicious. The research highlights the importance of monitoring DNS activity for early threat detection. 3 sources 59

Researchers identify AliExpress

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)