Loyalty Points Bot

A loyalty points bot is used by adversaries to steal loyalty points from user accounts. These are used to purchase goods and services either on the issuing site or downstream on third party sites that accept the loyalty points.

Show Techniques

|

Hide Techniques

Resource Development 4 Tactics

Payment Detail Acquisition

• Data Dumps
• Person in the Middle
• Social Engineering

Credential Acquisition

• Data Dumps
• Person in the Middle
• Social Engineering
• Valid Accounts

Infrastructure Acquisition

• Botnet
• Command & Control
• Proxies
• Supply Chain Compromise

Tool Development

• Development of Tools
• Testing of Tools
• Campaign Reuse

Reconnaissance 2 Tactics

Specific Target

• Technical Reconnaissance

Loose Target

• Technical Reconnaissance

Defence Bypass 4 Tactics

Mitigation Bypass

• CAPTCHA Farm
• Automated CAPTCHA Bypass
• MFA Bypass
• Token Bypass
• Cookie Abuse
• Credential Pinning

Human Emulation

• User Agent Spoofing
• Device Fingerprint Emulation

Proxying

• Botnet
• User Agent Spoofing
• IP Rotation

Smokescreening

• Volumetric Traffic Disguise
• Target Diversification

Attack Execution 3 Tactics

Payment Detail Abuse

• Loyalty Points Abuse

Fake Interaction

• Overlay Attack

Stock Purchase

• Automated Purchase

Actions on the Objective 1 Tactics

Exfiltration

• Payment Detail Dumping
• Automated Advertisement of Stock

Post-Attack 1 Tactics

Sale

• Information Brokerage
• Automated Sale
• Manual Sale