Fake AliExpress deals want to trick you into sharing credit card details
A seasonal phishing campaign impersonating AliExpress is targeting New Zealand organisations with fraudulent discount offers.
This phishing campaign uses fake AliExpress "Hot Summer Deals" to trick you into providing your personal or business credit card details. Scammers are sending high-volume emails featuring attractive 60% discounts to lure recipients toward a sophisticated credential harvesting portal.
This activity was flagged due to its sudden spike across several different local organisations and its deceptive use of professional marketing templates. The campaign demonstrates a coordinated effort to catch staff off guard by leveraging a well-known international retail brand.
The technical details contain a significant contradiction: while the emails pass technical checks, the lure features "Summer" branding despite it being winter in New Zealand. Furthermore, the messages originate from an unrelated commercial domain, shoppingbestof.shop, which has no official connection to AliExpress or its parent company, Alibaba Group.
The surprising detail is the visual fidelity of the campaign, which includes realistic product imagery and high-contrast buttons that lead to a convincing replica of the official shopping portal. This level of visual groom is designed to lower your guard and bypass standard security suspicions during a routine day.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check the Sender: Official AliExpress communications will only originate from verified aliexpress.com domains.
- Verify the Context: Be sceptical of seasonal lures (like "Summer Deals") that do not match the local New Zealand climate.
- Use Your Bookmarks: Never click links in unexpected promotional emails.
- Enable 2FA: Ensure multi-factor authentication is active on all accounts.
See what a genuine AliExpress message looks like, the real sender domain, the real link destination, and where to report a fake.