“Why Am I the Only One Who Never Gets the Coupon?”
A Real Story of an Automated Attack Against a Shopping App
“I set an alarm and entered the app exactly on time. How is the event already over the moment I get in?”
A shopping app's customer support team began receiving similar complaints repeatedly.
From first-come, first-served discount coupons and livestream shopping rewards to limited-quantity promotional events, the pattern was always the same. A small group of users consistently succeeded, while the majority always seemed to be one step behind.
At first, the company assumed it was simply a traffic surge.
After all, when thousands of users access an event simultaneously, server delays are expected.
But something didn't add up.
It always happened at the same time.
It was always the same types of accounts.
And the response speed was faster than any human could realistically achieve.
That was when the operations team realized:
“This isn't just a traffic problem.”
Why Are Shopping Apps Attractive Targets for Attackers?
Shopping apps are not just content platforms.
They contain assets with direct monetary value, including:
• ✔ Discount coupons
• ✔ Reward points
• ✔ Payment information
• ✔ Shipping information
• ✔ Seller transaction data
All of these assets are directly connected to real financial value.
From an attacker's perspective, a successful attack on a shopping app can immediately generate profit.
And among all available targets, coupons, discounts, and reward points are usually the first to be exploited.
How the Attack Actually Worked
The true nature of the problem became clear after analyzing application logs.
Confirmed Attack Patterns
• ✔ Mass collection of coupons through automated clicking tools and macros
• ✔ Abnormal repeated requests targeting event participation buttons
• ✔ Modified applications designed to bypass point deduction logic
On the surface, these users appeared to be normal customers.
In reality, they were using a combination of automation tools and tampered applications.
Where Was the Security Gap?
The shopping app had one fundamental weakness:
It could not distinguish between legitimate user behavior and abnormal activity.
• ✔ The server simply processed incoming requests.
• ✔ The application trusted its execution environment.
• ✔ There was no reliable method to identify automation or tampering.
This was the point where application security became essential.
LIAPP: The First Line of Defense Against Attacks Targeting Monetary Assets
Detecting Automated Input and Script-Based Attacks
LIAPP does not focus solely on what users enter.
Instead, it analyzes how they interact with the application.
• ✔ Touch intervals
• ✔ Input speed
• ✔ Repetition cycles
• ✔ Event request patterns
Input behavior that exceeds human capabilities eventually reveals automated activity.
Using this approach, automated clicking tools and macro-driven accounts began to be detected and blocked.
Detecting Application Tampering
Some attackers used even more sophisticated techniques.
They would:
• ✔ Repackage the legitimate application
• ✔ Modify the point deduction logic
• ✔ Participate in events while appearing to be normal users
LIAPP's anti-tampering capabilities analyze:
• ✔ Application code
• ✔ Resources
• ✔ Structural modifications
Based on these indicators, tampered applications can be identified before they operate normally.
As a result, modified applications targeting coupons and reward points could no longer participate in legitimate event flows.
“The Problem Wasn't Just Coupons”
Why LISS and LIKEY Were Also Needed
As the investigation continued, another important fact emerged:
Attackers were not only targeting coupons.
LISS – Detecting Remote Access and Remote Control Tools
Evidence of screen manipulation through remote support applications was discovered on several operational and seller accounts.
With LISS, the company was able to:
• ✔ Detect remote support and remote control tools
• ✔ Reduce the risk of external manipulation of sensitive accounts
This significantly improved the protection of operational and seller environments.
LIKEY – Protecting Accounts and User Input
Another weak point was the login process itself.
To address this risk, the company implemented LIKEY's secure mobile keypad.
Benefits of LIKEY
• ✔ Preventing credential theft through keylogging attacks
• ✔ Strengthening protection for administrator and seller accounts
By securing the input stage, attackers could no longer easily obtain account credentials.
What Changed After Implementation?
The impact of the security measures appeared faster than expected.
• ✔ Fairer distribution of coupons and reward points
• ✔ More natural distribution of successful event participants
• ✔ Reduced customer complaints
• ✔ Lower operational workload for support teams
However, the most important change was not technical.
It was a change in perspective.
The company shifted from:
“Looking only at the server when problems occur”
to
“Analyzing both the application runtime environment and user behavior.”
The Key Lesson from This Case
One of the biggest misconceptions in shopping app security is:
“As long as the server is secure, everything is secure.”
But real attacks often begin inside the application itself.
They imitate legitimate user behavior.
They quietly exploit coupons, points, and other assets with financial value.
What Is Needed?
• ✔ Automation and application tampering detection → LIAPP
• ✔ Detection of external manipulation environments → LISS
• ✔ Protection of sensitive user input → LIKEY
When each solution performs its specific role, security does not become more complicated—it becomes more practical and effective.
#ShoppingAppSecurity #MobileSecurity #CouponAbuse #EventSecurity #MacroDetection #AutomationAttacks #AppTampering #RASP #EcommerceSecurity #SellerAppSecurity #AccountProtection #FintechSecurity #MobileAppSecurity #SecurityCaseStudy #SecurityTrends #LIAPP #LISS #LIKEY
