PharmaFraud: How online scams are targeting health shoppers

To health shoppers who need a prescription quickly or want to order something discreetly, online pharmacies can seem like the perfect solution. A Google search could lead to dozens of websites offering overnight shipping, confidential packaging, accessible prescription medications, and prices that seem too good to be true.

Unfortunately, Threat Researchers at Gen (the company behind Norton and Avast) have found that many of these websites are part of a single sprawling fraud operation. Its activities are part of a wider PharmaFraud phenomenon that has grown to include AI health influencers peddling dubious supplements on social media.

One criminal network, thousands of fake pharmacy sites

What may look like independent online pharmacies may actually be run by a single criminal organization. Gen Threat Researchers tracked one PharmaFraud operation, which they dubbed MediPhantom, and found that it was controlling more than 5,000 pharmacy-related domains. They detailed their findings in the Q2/2025 Threat Report.

MediPhantom runs the scam like a business, with live chat staffed by real people and a central phone system handling "customer service." The sites work in multiple languages and target shoppers across Europe, the U.S., Canada, Japan, and Australia.

Our researchers found that the network was using several tactics to reach victims and stay hidden:

• Hijacking legitimate medical websites by breaking in and adding its own pages, so visitors saw a familiar domain.
• Manipulating search results to reach Google’s first page (a tactic called SEO poisoning).
• Routing payments through its own fake checkout pages, hosted on separate domains, so card details went straight to the criminals, sometimes encouraging payment in cryptocurrency or wire transfer.
• Rotating its domains constantly, retiring and registering sites faster than some detection tools could keep up with.
• Hosting infrastructure on public platforms, hiding among legitimate traffic rather than running its own servers.

Below are several examples of PharmaFraud sites our Threat Researchers found.

Our Threat Researchers monitor these networks continuously, identifying and blocking fraudulent pharmacy domains and the fake payment pages behind them. When new sites appear, network analysis helps flag them quickly so fewer people ever reach them. The team also shares what it finds with international law enforcement to support coordinated takedowns.

Why PharmaFraud is dangerous

Illegal online pharmacies are dangerous because they may be selling counterfeit medications or contaminated pills. Some fake pharmacy websites exist only to harvest your credit card details or personal data. Others do ship something — but what arrives may be unregulated, mislabeled, or dangerous. And it could seriously harm your health.

According to Gen’s Q2/2025 Threat Report, testing has found that over a third of pills from these rogue pharmacies contain no active ingredient at all. Someone treating a serious condition may get worse while believing they’re being treated. Others are cut with toxic additives. In one U.S. enforcement case in late 2024, a network of fake online pharmacies sold millions of fentanyl-laced painkillers, killing at least nine people.

In a 2025 consumer behavior survey, the Alliance for Safe Online Pharmacies, an industry advocacy body, found that 27% of those who have purchased prescription medicines online report having personally received substandard or counterfeit medicine, or being harmed by a medicine they bought online.

Research by the National Association of Boards of Pharmacy (NABP) indicates that PharmaFraud is a widespread phenomenon. Nearly 95% of online pharmacies that offer prescription-only drugs operate illegally, the study found.

What illegal pharmacies sell, and why it works

Gen’s research found that scam pharmacies often focus on desirable medications that people may not want to be seen buying publicly. Because many of these treatments are high-risk, high-shame, or normally require a prescription, online shoppers may be willing to look past the red flags to obtain them. The sites prey on stigma, chronic illness, and misinformation.

The most common types of treatment advertised on fake pharmacy sites include sexual health drugs, weight-loss treatments, and prescription antibiotics, with websites selling both brand-name drugs and generic equivalents:

• Sexual health drugs: Viagra, Cialis, Levitra, Priligy, and generic equivalents like Cenforce and Fildena are commonly marketed.
• Weight-loss and diabetes treatments: This category includes Rybelsus and metformin, both diabetes treatments used off-label for weight loss.
• Hormone and fertility medications: Clomid, a fertility medication, appears alongside estrogens like estradiol and ethinylestradiol, which are used in contraceptives and hormone therapy.
• Common antibiotics: Amoxicillin, doxycycline, and Zithromax are widely listed, often with no prescription required. Antibiotics taken unnecessarily or at the wrong dose can drive antibiotic resistance.
• Questionable treatments: This category includes ivermectin, an antiparasitic drug falsely promoted as a COVID-19 treatment; tretinoin, sold for acne without any dermatological oversight; and Propecia for hair loss, which contains finasteride and can have significant hormonal effects.

Many of these drugs are genuinely risky without proper medical guidance, and others may be illegal to sell altogether.

How PharmaFraud scams target customers

PharmaFraud scams stick to a familiar playbook to try to get you to buy the fake medications they’re hawking. They target potential victims through:

• Phishing emails with too-good-to-be-true prices and official-looking logos.
• Malicious ads on adult websites and even mainstream platforms like Facebook and YouTube.
• Manipulated Google search results.
• AI-generated fake health blogs that redirect to scam pharmacies.
• Redirects from AI chatbots.
• AI influencers peddling dubious supplements on social media.
• Fake review sites that rank scam pharmacies highly using fabricated ratings and testimonials.

AI tools allow cybercriminals to scale scams like PharmaFraud. Using AI web builders, scammers can launch highly realistic fake websites in mere minutes. Our Threat Researchers call these AI-built scam sites VibeScams.

AI influencers as an emerging threat

Another way scammers are targeting health shoppers is by utilizing fake social media influencers to promote their products. A recent New York Times investigation of AI health influencers uncovered a network of hundreds of AI-generated “doctors” and wellness influencers hawking unregulated supplements on social media. These “avatars” are making exaggerated health claims, targeting vulnerable populations, and profiting off medical misinformation.

The Times found these avatars are cheap and fast to produce: one agency in China turns out roughly 1,200 AI ad videos a day at about $10 each. Creators dress them up as physicians or traditional-medicine experts, complete with fake diplomas on the walls of fake offices.

Marie Claire UK examined what that shift means for anyone researching their health online. Mid-life women are the group PharmaFraud targets most often, Bilge told the publication, with the drugs on offer skewing toward weight loss, sexual health, hormones, and antibiotics.

The scam supplement operations investigated by The Times aren’t necessarily the same as the counterfeit pharmacy network our researchers tracked, but the two schemes share a toolkit and a target, and social media is already a proven route into the fake pharmacies.

Red flags to look out for when shopping for medication online

Once health shoppers are on the site, the scammers have already crossed the biggest hurdle. The sites often appear professionally designed, offer customer service chats, and have detailed product pages. An online pharmacy might be fraudulent if you spot any of these potential red flags:

• No prescription required, or a checkbox questionnaire rather than an official telehealth consultation.
• Prices that seem too low.
• No way to contact a licensed pharmacist.
• Awkward wording or sloppy design. But remember that AI now allows scammers to create professional-seeming websites.
• Logos that are just images, not clickable verification links.
• “Limited time offer!” buttons everywhere.
• Sketchy payment processors.
• Pressure to pay with cryptocurrency or wire transfers.

If you see any of these warning signs, chances are you’re encountering PharmaFraud.

How to stay safe when visiting an online pharmacy

PharmaFraud can put your finances and health in danger. To help stay safe when purchasing prescription medication online, try to stick to the following guidelines:

• Use verified pharmacies: In the U.S., use the list on the NABP website to find accredited digital pharmacies or the FDA’s BeSafeRx tool. In other countries, check with your local regulatory authority.
• Don’t skip the prescription: Real pharmacies require a valid one, not a checkbox form that approves everyone.
• Talk to a pharmacist: If something feels off, ask a professional. Licensed pharmacists are available to answer questions. That’s part of their job.
• Pay safely: Stick to credit cards or established payment methods. Wire transfers, strange payment portals, gift cards, and cryptocurrency are red flags.
• Check the store’s privacy policy: Your health data should be protected, not sold to marketers.
• Use AI-powered scam protection tools: Tools like Norton 360 Deluxe use AI to help block malicious sites and analyze suspicious content in real time. When choosing a scam protection tool, look for real-time website analysis, email scanning, and fraud alerts as key features, all of which can help stop PharmaFraud attempts before they reach you. attempts before they reach you.

Buying medication online can be convenient and safe — if you do it right. But illegal pharmacies are banking on the fact that you're in a hurry, embarrassed, or desperate. Always take the necessary steps to ensure your money and health stay safe.