Credit card thieves target WooCommerce sites with new skimmer

guest · Apr 13, 2020

Credit card thieves target WooCommerce sites with new skimmer
April 13, 2020
https://www.bleepingcomputer.com/ne...es-target-woocommerce-sites-with-new-skimmer/

Credit card thieves are targeting WordPress e-commerce sites powered by WooCommerce with a dedicated JavaScript-based card-skimmer malware instead of run-of-the-mill attempts to redirect payments to attacker-controlled accounts.

WooCommerce is a free and open-source WordPress plugin with more than 5 million active installs that makes it easy to run e-commerce sites that can be used to "sell anything, anywhere."

"Naturally, WooCommerce and other WordPress-based ecommerce websites have been targeted before, but this has typically been limited to modifications of payment details within the plugin settings," Sucuri's Ben Martin explained.
Cleaning its own tracks
However, as Martin further discovered, the credit card skimmer might have the capability of covering its own tracks as the files were zeroed out before he started analyzing the infected sites.
Click to expand...

While usually, the entry point used by attackers to infect an e-commerce site as part of a Magecart attack is simple to pinpoint, in this case it wasn't as obvious.
Click to expand...

Sucuri: Analysis of a WordPress Credit Card Swiper

With WooCommerce recently overtaking all other ecommerce platforms in popularity it was only a matter of time before we started seeing attackers target this platform more frequently.

This case is a perfect example of why both file integrity monitoring and regularly checking the integrity of your core files is crucial to maintaining a healthy, secure website.
As the threat landscape continues to evolve and more and more of our daily lives and transactions are conducted online it can’t be stressed enough that website owners bear the responsibility of keeping their websites (and by extension, their clients) secure.
Click to expand...

guest · May 17, 2020

WordPress malware finds WooCommerce sites for Magecart attacks
May 15, 2020
https://www.bleepingcomputer.com/ne...finds-woocommerce-sites-for-magecart-attacks/

Researchers at website security firm Sucuri have discovered a new WordPress malware used by threat actors to scan for and identify WooCommerce online shops with a lot of customers to be targeted in future Magecart attacks.
Buggy plugins used to hack e-shops
To hack into WooCommerce-based webshops and drop this new malware, the hackers are taking advantage of security vulnerabilities found in other WordPress plugins.

"It’s important to note that by default, the WooCommerce plugin does not store payment card data — attackers can’t simply steal sensitive payment details from the WordPress database," Sucuri malware researcher Luke Leal explains.
The malware is installed in the form of a malicious PHP script as part of the post-exploit stage that follows the successful compromise of a vulnerable WordPress site.
Click to expand...

Magecart reconnaissance
While Sucuri did not detail what this information can be used for, the malware operators can use the stolen order and payment information to decide if it's worth deploying skimmers specifically designed to target WooCommerce e-shops.

One such Magecart campaign targeting only WooCommerce stores was observed by Sucuri one month ago, with the credit card thieves being observed while injecting a dedicated JavaScript-based card-skimmer that harvested credit card numbers and card security codes (CVVs).
"This malware is a great example of attackers leveraging unauthorized access to determine new, potential targets within compromised hosting environments," Leal concluded.
Click to expand...

Sucuri: WordPress Malware Collects Sensitive WooCommerce Data

WooCommerce is a powerful WordPress plugin that can help a website owner set up an ecommerce store. WooCommerce’s popularity has allowed it to quickly grow a large market share and become one of the biggest ecommerce platforms in the world.
This popularity does not go unnoticed by attackers, and it’s the reason why we believe this platform has been targeted.
Click to expand...

guest · Jun 26, 2020

Hackers hide credit card stealing scripts in favicon EXIF data
June 25, 2020
https://www.bleepingcomputer.com/ne...t-card-stealing-scripts-in-favicon-exif-data/

Hackers are always evolving their tactics to stay one step ahead of security companies. A perfect example of this is the hiding of malicious credit card stealing scripts in the EXIF data of a favicon image to evade detection.
Continually evolving to better steal your credit cards
In a new report by Malwarebytes, an online store using the WordPress WooCommerce plugin was found to be infected with a Magecart script to steal customer's credit cards.

"The abuse of image headers to hide malicious code is not new, but this is the first time we witnessed it with a credit card skimmer," Malwarebytes' Jérôme Segura stated in the report.
After further investigation, Malwarebytes discovered that this favicon, while appearing harmless, actually contained malicious JavaScript scripts embedded in its EXIF data, as shown in the image below.

Malwarebytes was able to find the kit that was used to create and perform this magecart attack. After further analysis, it was determined that this attack might be linked to a threat actor group known as 'Magecart 9'.
Click to expand...

Malwarebytes: Web skimmer hides within EXIF metadata, exfiltrates credit cards via image files

Log in or Sign up

Credit card thieves target WooCommerce sites with new skimmer

guest Guest

guest Guest

guest Guest

Log in or Sign up

Credit card thieves target WooCommerce sites with new skimmer

guest Guest

guest Guest

guest Guest

Useful Searches