Black Friday and Cyber Monday squeeze a quarter's worth of traffic, transactions and pressure into a handful of days. Attackers plan for it the same way your merchandising team does. What separates a bumpy week from a genuinely bad one is rarely the tooling you buy in November — it is the hunting work done in October, while the site was quiet and the logs were boring.

Before the Hunts: Baselines, Inventory and Log Readiness

Peak season destroys your baselines. Traffic mixes shift, marketing sends fire at odd hours, resale bots start sniffing around, and every dashboard you trust looks wrong at 3 a.m. Build a reference point now, not on the morning of the sale.

Pull the equivalent week from last year if you still have it: login volumes, error rates, WAF blocks, checkout completion, order values, and the countries or ASNs your real customers come from. Then map the surfaces that matter. Checkout and payment endpoints get the attention, but the softer targets are the ones attackers actually farm during a rush:

• Login, registration and password-reset flows, including mobile APIs
• Guest checkout, one-click reorder and stored-card paths
• Promo code redemption and loyalty point endpoints
• Gift card balance checks and activation
• Order status and returns lookups that leak personal data
• Partner, marketplace and fulfillment integrations

Confirm log retention covers the whole window plus thirty days after, that your pipeline can absorb the volume spike, and that the queries you plan to run actually work against the indexed fields. A hunt that takes forty minutes per query is a hunt nobody runs on the busiest day of the year.

Credential Stuffing: Hunt the Login Path, Not Just the Firewall

Stuffing is automated reuse of username and password pairs stolen somewhere else. It succeeds because people reuse passwords, and it hides because it looks like ordinary customer confusion. Your WAF will catch the loud version. Hunt the quiet one.

Signals worth alerting on

• Failed-login velocity per account, per ASN and per device fingerprint, not just per IP
• Accounts with a long failure streak followed by a success from a new network
• Login attempts against accounts that have never had a session from that region
• A sudden run of password resets that closely follows a login spike
• Uniform response times on password reset or account lookup — a sign of enumeration
• Header order, TLS fingerprint or client hints that do not match the declared browser

Write two or three reusable queries for these and pin them to a dashboard. When the spike comes, you want answers in minutes, not a research project.

On response, resist blanket account lockouts. They punish real customers during the exact week you cannot afford to lose them. Prefer per-account rate limiting, step-up authentication, device binding, and blocking on the proxy and ASN layer. If you can check credentials against known-compromised sets, do it at login rather than forcing global resets.

Web Skimmers: Chase the Script Supply Chain Into Checkout

Skimmers do not brute force anything. They get a script onto your payment page — through a tag manager, a third-party vendor, a compromised CDN or a stale plugin — and quietly post card data to an endpoint you have never heard of.

Hunts that find them

1. Maintain a complete inventory of every script loaded on every checkout step, and review diffs daily.
2. Ingest CSP violation reports and treat new egress destinations as incidents until proven otherwise.
3. Alert on JavaScript files served from your own domain or CDN that change outside a deploy window.
4. Hunt for card-shaped strings — long digit runs and base64 blobs — leaving browsers toward unfamiliar hosts.
5. Monitor registrar, DNS and certificate changes for the domains that serve your payment pages.
6. Watch tag manager container versions for edits nobody on your team made.

If PCI DSS v4.x applies to you, the requirements around managing payment page scripts and detecting tampering are directly relevant here — but treat them as a floor, not a hunting plan. Subresource integrity, a strict content security policy and a short list of approved vendors will do more good than a quarterly scan.

Skimmers rarely announce themselves. The only reliable signal is change: a new script, a new domain, a new outbound destination on a page that should never talk to strangers.

Payment Fraud and Account Takeover: Follow the Small Signals

Fraud hunting during peak is about ratios and sequences, not single events. Card testing shows up as clusters of small declines from one device or a run of sequential card numbers. Account takeover shows up as a fresh device, a new shipping address, and a purchase pattern the customer has never used before.

Pull your fraud, trust and safety, and SOC analysts into the same channel early. Most holiday losses come from signals that existed in two separate dashboards and never got joined. Build a short list of combined hunts: new account plus immediate high-value order, many cards plus one device, gift card balance checks plus rapid redemption, promo code stacking plus address churn.

A Prep Timeline You Can Start This Week

1. Six weeks out: finish baseline pulls, log retention checks and dashboard repairs.
2. Four weeks out: write and save the stuffing, skimmer and fraud queries. Test them against staging traffic or replayed logs.
3. Two weeks out: rehearse. Run a tabletop with SOC, fraud and engineering; confirm who calls whom at 4 a.m.
4. One week out: freeze non-essential checkout changes, confirm vendor contacts, and brief on-call staff on the runbooks.
5. During the event: triage from the pinned dashboard, log every detection hit, and keep a running timeline in one shared document.
6. After the rush: review, tune thresholds, and archive the queries with notes on what produced noise.

Rehearse Before the Rush, Not During It

A detection nobody has tested is a guess. Fire synthetic stuffing attempts, inject a test script into a staging checkout, and see whether the alerts land where you expect. Check that your escalation paths still work when the primary on-call is already on a bridge call, and that dashboards refresh without someone hitting F5.

Also accept that false positives will spike alongside traffic. Decide in advance which alerts get muted, which get queued, and which wake people up. Write that decision down so nobody relitigates it mid-incident.

Make the Season a Habit, Not a Sprint

The stretch after Cyber Monday is the most valuable hunting window of the year. You have fresh baselines, a log of every alert that fired, and a clear picture of which queries earned their keep. Fold the good ones into standing detection, retire the rest, and write a short note on what you would do differently.

Peak trading is unforgiving, but it is also predictable. Attackers show up on the same calendar you do. Prepare the queries, know your normal, keep the playbooks reachable, and the busiest week of the year becomes a manageable one.

Photo: Leeloo The First / Pexels