Black Friday 2025 recorded 29 thousand fraud attempts in four days, causing losses of R$ 30.7 million

Fraud in the telecommunications sector in Mozambique decreased by 64% during 2025, totaling 195,045 cases. However, the regulator warned that fraud schemes are becoming more elaborate, which poses an obstacle both to network security and user protection.

According to the Telecommunications Security and Resilience Report 2025, published by the National Institute of Communications of Mozambique (INCM), the recorded incidents generated an accumulated financial loss of 128.31 million meticals. This data indicates that the drop in the volume of occurrences did not result in the elimination of damages caused by fraudulent practices.

The report was presented to the sector's service providers last Tuesday, and it assesses the security and reaction capacity against fraud, threats, technical failures, and other problems in mobile telephony, internet, and television transmission services.

Among the most common forms of fraud pointed out, the 'Wangiri' modality stands out, which involves short calls made to convince recipients to return the call, often to international or value-added numbers. Other modalities include SIMBOX, linked to the undue diversion of international calls, and SMS Phishing, which uses fake messages to steal personal, banking, or access codes.

Helena Fernandes, chairwoman of the INCM board of directors, observed that the reduction in the number of frauds is a positive aspect. However, she emphasized that the constant evolution of fraud methods requires a continuous and well-coordinated response.

Quoted in the INCM statement recently released about the report, Fernandes stated: 'Although the registered reduction constitutes a positive sign, it is important to recognize that these and other types of fraud continue to represent a significant challenge to the security of the sector and to consumer protection. This requires us to remain vigilant and modernize our prevention, detection, and control systems.'

Additionally, the document points to risks arising from extreme weather events. It was mentioned that cyclones Dikeledi and Jude caused the shutdown of 174 telecommunication stations, highlighting vulnerabilities in infrastructure and the urgent need to strengthen system redundancy and ensure service continuity.

Faced with these challenges, the regulatory body advocates for strengthening collaboration between operators and industry entities. This should be done through rapid information sharing, systematic recording of incidents, promotion of digital education, and implementation of efficient mechanisms for reporting and preventing fraud.

A critical vulnerability in the data compression system is forcing technology companies to release security updates to prevent attacks that could compromise servers and applications. This vulnerability, named HTTP2Shell, affects Brotli—a technology developed by Google and used in various elements of internet infrastructure.

This breach is classified as very serious, with a score of 9.2 on a ten-point scale. It is capable of causing memory corruption, data leakage, service outages, and, under certain circumstances, remote code execution. The latter scenario allows an attacker to execute commands within the vulnerable system.

The issue, identified under the code CVE-2026-111497, is also known as Node2Shell and Broccoli2Shell. Among the software potentially at risk are Node.js, .NET applications, and Python packages using vulnerable versions of the Brotli decoder.

According to TechRadar, many companies and projects have already begun distributing fixes. However, at the time of publication, there was no confirmation that this vulnerability was being exploited in real-world malicious attacks.

The problem has prompted various projects to release security updates. Google updated the Brotli library on October 21st, releasing versions 1.0.10, 1.1.1, and 1.2.1. On the same day, Node.js also released patches. The vulnerability affects the 22.x, 24.x, and 26.x runtime lines used for running JavaScript code outside of browsers.

Over the weekend, Microsoft published an emergency update for .NET. The company warned that successful exploitation could lead to privilege escalation in vulnerable systems. Additionally, Python packages using the decoder received fixes on October 23rd.

TechRadar provided a list of patched versions but emphasized that having these versions does not mean that all systems using these technologies are vulnerable. The risk depends on the installed versions, the libraries used, and how each application processes data. It is also important to remember that some programs contain their own copy of the decoder, so administrators must check dependencies and update the components actually in use.

This race to fix HTTP2Shell draws attention to a broader issue: maintaining the security of digital infrastructure, which relies on numerous components, libraries, and servers that are not always updated regularly.

A recent warning concerning PHP—another widely used technology for building websites—showed how this problem can be exacerbated if maintenance personnel do not apply security patches. Although PHP vulnerabilities differ from HTTP2Shell, both cases illustrate the difficulties of securing systems dependent on software components maintained by different organizations.

According to CNET, the PHP Foundation itself, a non-profit organization supporting the language's security and development, operates with only one full-time employee and about 14 part-time staff, in addition to council volunteers. The organization's CEO, Elizabeth Barron, told Reuters that the demand for security changes in PHP code has increased due to the expansion of threats identified by artificial intelligence (AI), without a corresponding increase in staff.

Awareness among website owners is also a barrier. A study cited by CNET and conducted among 121 small business owners who maintain their own website showed that 45% had never heard of PHP, and 71% did not know whether their site used the technology.

Responsibility for applying fixes varies depending on the infrastructure. Some managed hosting services perform updates for clients, while owners of their own servers must act independently. For regular website visitors, updating a browser or changing passwords will not eliminate a server vulnerability at another organization; protection primarily depends on timely component updates and appropriate security measures taken by application administrators.

The main recommendation is to install available updates for affected components. After patching, processes may need to be restarted and container images rebuilt to ensure that services stop using vulnerable versions.

If an immediate patch cannot be applied, temporary measures exist to reduce risk. For Python applications, a temporary solution is to remove vulnerable Brotli packages and optional dependencies that use them. Administrators can also configure proxies, load balancers, or web application firewalls to block specific requests with Brotli-packed bodies. However, this measure does not provide complete protection for applications receiving malicious responses from other servers and attempting to unpack them. For Node.js, there is no full alternative to updating.

The nickname HTTP2Shell refers to another recent vulnerability known as PHP2Shell, which affected PHP, a language widely used in web development and applications. Both vulnerabilities share a worrying common aspect: under certain conditions, they can pave the way for remote code execution. This makes patching particularly important for organizations running internet-facing systems.

Nevertheless, the vulnerabilities themselves are different and affect different components. Fixing PHP2Shell does not automatically protect the environment from HTTP2Shell, just as updating Brotli does not solve specific PHP issues. In the case of HTTP2Shell, TechRadar mentioned public proof-of-concepts but did not indicate confirmed real-world exploitation. Despite this, the availability of fixes and the potential severity of the problem make checking affected systems a priority. The article 'Falha crítica ameaça sites e pode permitir que hackers executem códigos remotamente' first appeared in Olhar Digital.

The countdown to November 27th continues, and wish lists are being filled on all mobile devices. Previously, Black Friday was associated with one chaotic morning rush in stores; however, the promotional season is now stretching into weeks and extending far beyond retail outlets.

Takealot has confirmed the Blue Dot sales for another year. Furthermore, casinos are actively offering their seasonal promotions on the same screen where users compare sneaker prices. Sun International's online division demonstrated a 35.5% growth in the first half of this year, primarily driven by slots and casino games, meaning the competition for attention in November will not only be among retailers.

Firstly, stores in the Western Cape are the most active participants in the sales when discounts begin. Last year on Black Friday, Peach Payments had already processed twice the volume of transactions by 9 am compared to the same time in 2024. Approximately 65% of this amount came from the Western Cape, while Gauteng showed 34%. One trip was paid for R380,000 before most people finished breakfast.

Peach Payments is based in Woodstock, at Brickfield Canvas, and serves both retailers and bookmakers, so the same infrastructure that processes payments in a clothing store also handles casino deposits on the other side of the app. According to last year's data, the Western Cape will once again shop more actively and quickly than the rest of the country in November.

Secondly, promotions are not limited to stores. Sun International, owner of GrandWest, reported that its online revenue increased by 35.5% in the first half of 2026, compared to the national growth in online gambling, which was about 19%. Growth is still mainly driven by slots and casino games among regular customers, prompting platforms to actively use promotions to maintain player engagement during the holiday period. Free spins, deposit bonuses, and cashback are now appearing in the same inbox as retail store newsletters.

The South African online casino market is running its own version of a seasonal sale, offering promotions that change weekly throughout November and December. The difference is that the retail promotion is simple: you see the price and buy, whereas the casino promotion usually includes wagering requirements and withdrawal limits that must be read carefully. Checking the terms before agreeing is equivalent to studying the return policy before buying a television.

Thirdly, your payment method determines whether you receive a discount. According to the 2026 Online Retail Report by Peach Payments and World Wide Worx, Capitec Pay processes about 40% of the payment value in some payment systems, and the growth of payments through digital wallets reached over 35% year-on-year. The flip side is that 61.2% of retailers cited card declines as the main reason for abandoned carts. A card decline when checking out on Black Friday means someone else will get your deal.

Maintaining a backup payment method, whether it's a second card, an instant bank transfer option, or a digital wallet, is basic preparation. The same applies to topping up a casino account during a promotion. A failed deposit in the middle of a bonus window can lead to a complete loss of the offer. Payment methods need to be set up before the season starts, not when you are looking at the countdown timer.

Fourthly, Takealot is starting the countdown again. Takealot has confirmed its annual Blue Dot sale this year, with additional discounts for TakealotMORE members. The full list of promotions has not yet been revealed, but the format is familiar: daily deals, limited stock items, and exclusive app offers that sell out quickly.

In last year's sale, categories such as electronics, home appliances, and cosmetics were leaders in the early hours. A wise move is to set up your account, save payment details, and add items to your wish list before the sale starts. Waiting until morning to browse means competing with millions of other people for the same item.

Finally, budget for the entire season, not just for one Friday. Wonga estimates holiday spending at R289 billion, and a UCT study shows that South Africa's holiday economy amounts to over R500 billion annually. This is a significant amount of money leaving accounts between November and January.

The temptation is to view Black Friday as a one-off event, but promotions, whether retail or casino, run for weeks before and after. It is worth spending five minutes comparing offers on their actual terms, not just the advertised discount, whether you are comparing two televisions or two deposit bonuses. Enter the season with a specific amount in mind and a plan on how to stick to it.

There are six weeks left until Black Friday, which is enough time to create a budget, organize payment methods, and decide what you truly want before the noise begins. Offers will appear in both stores and casinos. Those who approach the promotional season with a plan benefit the most.