A massive online scam is targeting shoppers using realistic ads and fake websites that spoof well-known brands. Known as the GhostVendors campaign, this threat has already compromised over 4,000 domains. And your browser likely won’t protect you.

What Is GhostVendors?

Researchers at Silent Push have flagged this as one of the largest ongoing fake marketplace scams. These scams start with malicious Facebook Marketplace ads that redirect users to fraudulent online stores mimicking popular brands. Once users interact or place orders, the attackers shut down the ads and rotate to fresh domains. The entire process is fast, leaving little trace.

How It Works

• Step 1: Facebook ads promote deals from well-known brands.
• Step 2: Clicking the ad takes users to a fake version of the brand’s website.
• Step 3: Scammers collect payment and personal information.
• Step 4: Ads and domains are deleted, making them harder to track.

These scam domains are typically live for only a few minutes to a few hours, just enough time to deceive users. Then a new domain is activated, and the scam cycle continues.

Brands Being Impersonated

The list of spoofed brands includes:

Amazon, Costco, Bath & Body Works, Nordstrom, Rolex, Crocs, Instacart, Saks Fifth Avenue, Dollar General, GE Appliances, Birkenstock, Party City, Hoka, L.L. Bean, Vionic, Tommy Bahama, Joann, Thrive Market, and many more.

The scammers are targeting brands that invest heavily in online advertising, blending in with authentic campaigns.

Why It Matters

Modern browsers like Chrome, Safari, and Edge rely on blacklists to detect malicious sites. But these blacklists can’t keep up with the pace at which these scam domains rotate. Even AI-based tools aren’t fast enough yet.

And it’s not just consumers at risk. This campaign also affects:

• Major advertising networks
• Brand reputations
• Social media platforms

How to Protect Yourself

• Don’t click on ads in messages or social media. Go directly to the brand’s site instead.
• Watch for spelling errors in URLs. Many scam domains mimic legitimate ones.
• Be skeptical of steep discounts. If it looks too good to be true, it usually is.
• Use updated security tools, but know they’re not foolproof.
• Avoid impulse buying through social platforms.

Silent Push’s Final Note

According to Silent Push, the GhostVendors campaign is being run by multiple threat actors. Many of them reuse templates to launch scams quickly. This mass domain registration strategy helps them stay ahead of detection.

“Web shop and fake marketplace scams are a prolific global threat,” says Silent Push. “They target consumers, brands, and ad networks alike.”

Until real-time detection improves, the safest way to avoid getting scammed is to stay off unknown websites and never shop through third-party links.