Threat actors exploited the high volume of legitimate Black Friday marketing to run convincing phishing campaigns impersonating retailers like Amazon and Louis Vuitton, using newly registered domains, redirects, and cloud-hosted links to harvest credentials or deliver payloads. Darktrace / EMAIL detected and blocked multiple such campaigns in November 2025 by identifying anomalous senders, short-lived domains, and hidden malicious links #Amazon #Darktrace