Magecart Attacks Grow Rampant in September

guest · Mar 20, 2019

Consumers May Lose Sleep Over These Two New Magecart Breaches
March 20, 2019
https://www.riskiq.com/blog/labs/magecart-mypillow-amerisleep/

In this blog, we’ll document two Magecart-related breaches against bedding retailers MyPillow and Amerisleep. One has been resolved but was never disclosed and another is ongoing despite numerous attempts by us to contact the affected retailer. In both cases, the potential victims of credit card fraud, the consumers, have not been informed.
Note: In both breaches, only online payments were affected, not physical transactions.
MyPillow
The attackers played a brilliant game the second time they placed a skimmer on the MyPillow website, adding a new script tag for LiveChat that matched a script tag usually inserted by the LiveChat scripts. The Magecart attackers went even further by proxying the standard script returned from the real LiveChat service and appended the skimmer code below it: [...]
AmeriSleep
In December 2018, the attackers had used a new skimming setup with a fascinating new method. The attackers abused Github by registering a Github account called “amerisleep” and creating the Github Pages address amerisleep.github.io: [...] The jquery_validator.js script contained a skimmer that was included on the Amerisleep website directly: [...]
Click to expand...

guest · Mar 29, 2019

Magento's Latest Patches Should Be Applied Immediately
SQL Injection Flaw Can Be Exploited Without Authentication, Privileges
March 29, 2019
https://www.databreachtoday.com/magentos-latest-patches-should-be-applied-immediately-a-12292

Magento, which is part of Adobe, has released a patch that repairs several serious vulnerabilities, one of which requires no authentication and is easy to exploit, writes Marc-Alexandre Montpas of Sucuri, a website security company.

"The number of active installs, the ease of exploitation and the effects of a successful attack are what makes this vulnerability particularly dangerous."
The SQL injection flaw could be used to pull usernames and hashed passwords from databases such as Oracle and MySQL. The patch for this vulnerability, PRODSECBUG-2198, should be applied immediately. A full list of the flaws is available in Magento's advisory.

On the bright side, Sucuri says it hasn't seen any attacks yet in the wild, but it's not releasing its proof-of-concept exploit.
Card-Sniffers: All the Rage
E-commerce websites are under a relentless assault by criminal groups specializing in slipping payment card skimming malware into sites. Security vendors, including RiskIQ, Sucuri and Group-IB and others, have been tracking groups and techniques.
Click to expand...

guest · Apr 3, 2019

In-Depth Analysis of JS Sniffers Uncovers New Families of Credit Card-Skimming Code
April 3, 2019
https://thehackernews.com/2019/04/js-sniffers-credit-card-hacking.html

Magecart, which is in the news a lot lately, is an umbrella term given to 12 different cyber criminal groups that are specialized in secretly implanting a special piece of code on compromised e-commerce sites with an intent to steal payment card details of their customers.

The initial success of these attacks already indicated that we are likely going to be seeing a lot more of it in coming days.
Moscow-based security firm Group-IB today published a report, which it shared with The Hacker News prior to its release, detailing nearly 38 different JS-Sniffer families that its researchers documented after analyzing 2440 infected e-commerce websites.

Group-IB report also reveals that over half of the affected websites were attacked by the MagentoName JS-sniffer family. The attackers behind this card-skimmer exploited known vulnerabilities in sites running outdated Magento CMS to inject malicious code.
You can access the complete Group-IB report by visiting this link.
Click to expand...

Dozens of Credit Card Info Skimming Scripts Infect Thousands of Sites
https://www.bleepingcomputer.com/ne...o-skimming-scripts-infect-thousands-of-sites/

ronjor · Apr 3, 2019

Written by Jeff Stone Apr 3, 2019

And it’s not just Magecart, the best known group of JS-sniffers, Group-IB says. Twelve Magecart groups have been in operation, but Group-IB says its researchers discovered a total of 38 JS-sniffer families — at least eight of which have not previously been investigated in detail.
Click to expand...

guest · Apr 4, 2019

mood said: ↑

Magento's Latest Patches Should Be Applied Immediately
SQL Injection Flaw Can Be Exploited Without Authentication, Privileges
March 29, 2019
https://www.databreachtoday.com/magentos-latest-patches-should-be-applied-immediately-a-12292
Click to expand...

Update: 37 security issues re:critical flaw in Magento e-commerce platform
April 3, 2019
https://www.scmagazineuk.com/update...w-magento-e-commerce-platform/article/1581035

[...] the latest Magento updates deal with a lot more issues than the SQL injection mentioned - 37 security issues altogether. They add that it's essential that webmasters and store owners update ASAP and have provided information about the March 2019 updates and how to install them here.
Click to expand...

guest · Apr 24, 2019

Hackers hit Atlanta Hawks shop with malware that steals credit card information
April 23, 2019
https://www.cnet.com/news/hackers-hit-atlanta-hawks-with-malware-stealing-credit-card-information/

The merchandise website for the Hawks, the 12th-ranked team in the NBA's Eastern conference, was infected with malware designed to steal credit card information, according to Willem de Groot, lead forensic analyst at Sanguine Security.

De Groot said he first spotted the malware April 20 and noted it was stealing the names, addresses and credit card numbers of Hawks fans. He said he notified the team on Tuesday.
"We take these threats seriously and are investigating," a Hawks spokesperson said. The malware is no longer active on the site, the representative said.

De Groot said Magecart, which targets popular online stores with security vulnerabilities, also hit Hawks Shop, a site for Atlanta Hawks fans to buy hats, jerseys and other team gear.
"The frequency of hacked stores has gone down somewhat. However, the volume of stolen transactions apparently has gone up," de Groot said.
Click to expand...

guest · Apr 27, 2019

GitHub-Hosted Magecart Card Skimmer Found on Hundreds of Stores
April 26,2019
https://www.bleepingcomputer.com/ne...art-card-skimmer-found-on-hundreds-of-stores/

Malicious actors compromised the Magento installations of a few hundred e-commerce websites and injected them with Magecart skimmer scripts hosted on GitHub.
The GitHub-hosted MageCart skimmer
The payment card scraper script discovered on GitHub was uploaded on April 20 and it was obfuscated using hexadecimal encoding as unearthed by Malwarebytes security researcher Jérôme Segura.

The researcher was able to observe the malicious actor during the process of setting up the scraper script, starting with a couple of tests and ending up with the final obfuscated skimmer payload, ready to be injected into compromised Magento stores.
"Just like with any other kind of third-party plugins, compromised Magento sites are loading this script within their source code, right after the CDATA script and/or right before the tag," says Segura.
Click to expand...

Malwarebytes: GitHub hosted Magecart skimmer used against hundreds of e-commerce sites

guest · Apr 30, 2019

Info-stealing malware pounces on Puma Australia's webstore
April 30, 2019
https://www.itnews.com.au/news/info-stealing-malware-pounces-on-puma-australias-webstore-524434

The Australian webstore of Puma continues to be infected by malware that exfiltrates customer details, with the multinational sports gear vendor not responding to alerts about the compromise.

Willem de Groot of security vendor Sanguine Security confirmed to iTnews that despite notifiying Puma's Australian online e-commerce operation, the site continues to be infected by Magecart malware.
Magecart is a skimmer malware that targets vulnerable Magento webstores, and Sanguine Security detected the infection on April 25.
The 2.2 version of Magento running on Puma Australia's webstore appears to have been patched against a critical vulnerability as of yesterday, de Groot said.

That the webstore continues to serve up malware could be due to the attackers gaining access before the patch was applied. Attackers may also have exploited insecure third-party components such as marketing plug-ins, database management tools and accounting software to gain access to the core shop system de Groot said.
Click to expand...

guest · Apr 30, 2019

Polymorphic skimmer targets 57 payment gateways
It has global reach, affecting payment systems from Germany to Brazil. It is by far the most advanced skimmer to date.
April 29, 2019
https://labs.sansec.io/2019/04/29/polymorphic-skimmer-57-payment-gateways/

Sanguine Security discovered a polymorphic skimmer that works with 57 different payment gateways.
This skimmer consists of two components: a polymorphic loader, and a sophisticated exfiltration mechanism that supports dozens of payment gateways.
The skimmer uses jqueres.com as bootloader and exfiltration server. The domain points to a Ukraine-registered server. The loader has been injected into dozens of stores, with Puma Australia being the latest case.
A polymorphic loader
Skimmers are in the business of hiding their code well. It’s trivial to render code unreadable (using code obfuscators) but the very presence of unreadable code is clearly suspicious.
The skimmer’s solution is to use polymorphic code.
What does this all mean
The sophistication of this skimmer clearly demonstrates the automated workflow of skimmers. It also suggest a collaborative effort: there is no way that a single person could study all of these localized payment systems in such detail.
Click to expand...

Effectively, it is a sign of the maturity of the online skimming industry, which is here to stay for a while.
Click to expand...

guest · May 2, 2019

Magecart Group 12 Targets OpenCart Websites
May 2, 2019
https://www.bleepingcomputer.com/news/security/magecart-group-12-targets-opencart-websites/

Gangs using malicious JavaScript code to steal payment info target multiple online shopping platforms used by thousands of small stores; more advanced ones rely on tactics to remain undetected for a longer period.

According to RiskIQ telemetry data, OpenCart is in the top three most frequent shopping platforms worldwide, powering thousands of online stores, both large and small. It is surpassed only by Shopify and Magento.

"With the ubiquity of these platforms (especially with self-hosted solutions) it’s often exposed to vulnerabilities that make it a prime target for skimming attacks," says Klijnsma.
Klijnsma says that Magecart Group 12 sees a target in anything providing e-commerce services, breaching thousands of websites that ran versions of Magento, OpenCart, and OSCommerce.
Click to expand...

guest · May 3, 2019

Attackers Steal Payment Info from 200 College Campus Online Shops
May 3, 2019
https://www.bleepingcomputer.com/ne...nt-info-from-200-college-campus-online-shops/

The checkout pages of hundreds of U.S. and Canadian online campus stores powered by the PrismWeb e-commerce platform were injected by a hacking group with a JavaScript-based payment card skimming script.
The PrismWeb skimming script
Further analysis showed that the data skimmer scripts used in these attacks stole the customers' payment information and personal details, sending all of it afterward to a server controlled by the attackers.
As Chen also unearthed, the script was specifically created for the PrismWeb e-commerce platform as it will only collect data from "HTML elements with the specific IDs" found within PrismWeb checkout pages.

Because they weren't able to make any connections with other Magecart groups, Trend Micro considers it a new group and dubbed it Mirrorthief.
Click to expand...

Trend Micro: Mirrorthief Group Uses Magecart Skimming Attack to Hit Hundreds of Campus Online Stores in US and Canada

guest · May 15, 2019

Hackers Inject Magecart Card Skimmer in Forbes’ Subscription Site
May 15, 2019
https://www.bleepingcomputer.com/ne...art-card-skimmer-in-forbes-subscription-site/

As revealed by Bad Packets Report's co-founder Troy Mursch, the script collects card numbers, expiration dates, and credit card CVV/CVC verification codes, as well as customers' names, addresses, phone numbers and emails.

While the obfuscated Magecart script can still be found on the forbesmagazine.com website, the domain used by the attackers to collect the stolen payment information has been taken down using Freenom's abuse API which makes it possible to take down malicious domains immediately.
The attackers used the WebSocket protocol to exfiltrate the stolen data [...]

Magecart campaigns are still going strong seeing that security outfit Group-IB found 2,440 compromised websites during early April which had been infected with payment card skimming scripts.
Click to expand...

guest · May 21, 2019

Hackers Steal Payment Card Data Using Rogue Iframe Phishing
May 21, 2019
https://www.bleepingcomputer.com/ne...ayment-card-data-using-rogue-iframe-phishing/

Cybercriminals have upgraded their credit card skimming scripts to use an iframe-based phishing system designed to phish for credit/debit card info from Magento-powered store customers on checkout.

In this case, as Malwarebytes security researcher Jérôme Segura discovered, the crims injected their credit card stealer scripts within every page of the hacked websites and configured it to pop-up as a phishing form asking the buyers to provide the info themselves.
However, the iframe-based skimming discovered by Segura one-ups Magecart Goup 4's devious strategy by displaying a credit card phishing form on the page where customers are redirected to the payment service provider (PSP), a place where online shops would never ask their users for payment info given that the payment process is externalized to the PSP.

As Segura found out, the crooks injected all the pages of hacked Magento websites with this iframe-based credit card phishing script but the phishing form will only be displayed on the store's checkout page.
The hackers first collect the data using the rogue iframe that gets created on the compromised using an obfuscated script loaded from thatispersonal [.]com, a domain registered and hosted in Russia.
Click to expand...

Malwarebytes: Skimmer acts as payment service provider via rogue iframe

guest · May 31, 2019

Own goal for Leicester City FC after fan credit card details snatched in merch store hack
May 31, 2019
https://www.theregister.co.uk/2019/05/31/leicester_city_fc_hacked_credit_card_data/

Leicester City Football Club has quietly told people who bought stuff from its website that their financial details have been stolen by hackers – and those details include credit card numbers and CVVs.
Reg reader Yazza, a Foxes follower, received an email from the British club 'fessing up to the hack attack, which affected its merchandise site, shop.lcfc.com.

The network intrusion itself took place on 6 May, with a follow-up email being sent earlier this week.

Technical investigations are still ongoing, but we can confirm that as a result of the incident your payment card information was compromised. This includes your card number, name of card holder, expiry date and CVV. We can confirm that your SecureCode was not compromised. That information is needed to attempt to conduct transactions using your account.
Yazza suspected that LCFC's site is running the Magento ecommerce platform and suggested to The Register that one potential attack vector could have been the Magecart malware.
An LCFC fan forum features posts where some appear to suggest that fraudulent transactions have been made on their credit cards following the hack.
Click to expand...

guest · Jun 1, 2019

mood said: ↑

Own goal for Leicester City FC after fan credit card details snatched in merch store hack
May 31, 2019
https://www.theregister.co.uk/2019/05/31/leicester_city_fc_hacked_credit_card_data/
Click to expand...

Leicester City reveal details of 'criminal online security breach' related to online shop
June 1, 2019
https://www.leicestermercury.co.uk/...eicester-city-reveal-details-criminal-2931431

Leicester City say users of their online store had their personal and financial details compromised following a security breach.
The club say the breach affected some users between April 23 and May 4.

In a statement released today they say that supporters whose details were compromised were contacted immediately and told what to do.
The statement continues: "Upon discovery of the breach, the security of our retail platform was immediately restored and appropriate measures were taken to ensure the security of all other online assets.

"In line with its GDPR responsibilities, the club informed all necessary parties - including potentially affected users, the police and the Information Commissioners Office (ICO) - and launched an immediate investigation into the source of the breach.
Click to expand...

Club Statement: Online Security Breach

guest · Jun 4, 2019

Magecart skimmers found on Amazon CloudFront CDN
June 4, 2019
https://blog.malwarebytes.com/threa...cart-skimmers-found-on-amazon-cloudfront-cdn/

Late last week, we observed a number of compromises on Amazon CloudFront – a Content Delivery Network (CDN) – where hosted JavaScript libraries were tampered with and injected with web skimmers.
Some websites either use Amazon’s cloud infrastructure to host their own libraries or link to code developed specifically for them and hosted on a custom AWS S3 bucket.
The ideal place to conceal a skimmer
CDNs are widely used because they provide great benefits to website owners, including optimizing load times and cost, as well as helping with all sorts of data analytics. [...]
Finding and exploiting weaknesses
This type of attack on private CDN repositories is not new, but reminds us that threat actors will look to exploit anything that is vulnerable to gain entry into systems.

While this example is not a third-party script supply-chain attack, it is served from third-party infrastructure. Beyond applying the same level of access control to your own CDN-hosted repositories as your actual website, other measures—such as validation of any externally loaded content (via Subresource Integrity checks, for example)—can save the day.
Click to expand...

guest · Jun 28, 2019

MageCart Launches Customizable Campaign
A tool new to MageCart bolsters the group's ability to evade detection and steal data
June 28, 2019
https://www.darkreading.com/attacks-breaches/magecart-launches-customizable-campaign/d/d-id/1335087

MageCart, a loose group of individuals and organizations that specializes in JavaScript information skimmers used to compromise commercial websites, has a new offering for it customers — one that carries new dangers for website owners and customers.
According to researchers at Fortinet, MageCart is now licensing Inter. According to Inksit Threat Analysis, "Inter is a JS Sniffer (credit card sniffer) that Sochi has sold on Exploit forum since December 2, 2018.

One of the campaign's unique qualities, according to Fortinet's report, is that the software injects a fake card payment form on a targeted Web page and skims a victim's entered card information, whether or not the page is a checkout form. This means the skimmer can be brought into the customer experience much earlier.
What is new is the criminal group's use of this customizable, widely available tool.
Click to expand...

Fortinet: Inter: Skimmer For All

guest · Jul 5, 2019

Card Details Stolen from 962 Websites in 24-Hours Magecart Spree
July 5, 2019
https://www.cbronline.com/news/card-skimming-ecommerce-attack/

A massive 962 online shops have had their customers’ card details stolen in just 24 hours, in the largest Magecart-style automated card skimming card campaign identified to date.
That’s according to Amsterdam-based eommerce fraud protection specialist Sanguine Security Labs, which identified the attacks today.
The company – which provides a Magento malware scanner – has shared the skimmer’s codebase on a GitHub repo.

Willem de Groot from Sanguine Security told Computer Business Review: “This is the largest number of breaches [of] stores over a 24-hour period, which implies that their operation is highly automated. Victims are from all over the world, so were likely chosen opportunistically.”
He added: “I am still waiting for logs to accurately say how they got compromised, but at first glance it appears to be a PHP object injection exploit for an existing vulnerability.”
Click to expand...

guest · Jul 11, 2019

Hack Brief: A Card-Skimming Hacker Group Hit 17K Domains—and Counting
July 11, 2019
https://www.wired.com/story/magecart-amazon-cloud-hacks/

And thanks to poor security hygiene, they’ve managed to hit 17,000 domains in the past few months alone.

A new report from threat detection firm RiskIQ details how Magecart hackers have found a way to scan Amazon S3 buckets—cloud repositories that hold data and and other backend necessities for sites and companies—for any that are misconfigured to allow anyone with an Amazon Web Services account to not just read their contents, but write to them, implementing whatever changes they want.

“It’s still ongoing as we’re talking right now,” says RiskIQ threat researcher Yonathan Klijnsma. “All these guys are doing is just en masse trying to find S3 buckets that have been misconfigured. And their skimmers are getting everywhere.”
[...] 17,000 domains and counting, including, RiskIQ says, some that are among the 2,000 biggest sites in the world.
“This is a whole new level of misconfiguring,” says Klijnsma. “These buckets are pretty much owned by anybody who talks to it, which is on a different scale, a different type of data leakage. Pretty much anybody can do anything in those S3 buckets, and the reach of those is quite big.”
Click to expand...

RiskIQ: Spray and Pray: Magecart Campaign Breaches Websites En Masse Via Misconfigured Amazon S3 Buckets

guest · Jul 18, 2019

It's never good when 'Magecart' and 'bulletproof' appear in the same sentence, but here we are
July 18, 2019
https://www.theregister.co.uk/2019/07/18/magecart_ukraine_hosting/

Researchers with security shop Malwarebytes say that the data-exfiltration and hosting servers used by Magecart operations to collect harvested card details have been traced to the Ukrainian city of Luhansk, located in an area contested by pro-European and pro-Russian forces.
These data centers, pitched as 'bulletproof,' naturally appeal to groups running less-than-reputable operations that would be subject to raids or takedown requests if hosted in other locations.

"Due to the very nature of such hosts, takedown operations are difficult," Malwarebytes explained. "It’s not simply a case of a provider turning a blind eye on shady operations, but rather it is the core of their business model."

The use of bulletproof hosting is particularly bad in the case of Magecart, as it eliminates one of the more effective means of stopping the infection - disabling command and control servers.
Now, with the C&C and exfiltration servers stashed behind bulletproof hosts, Malwarebytes says it is having to block all domains and IP addresses associated with the skimmers.
Click to expand...

Malwarebytes: No man’s land: How a Magecart group is running a web skimming operation from a war zone

guest · Jul 26, 2019

Hackers Inject Multi-Gateway Card Skimmer via Fake Google Domains
July 26, 2019
https://www.bleepingcomputer.com/ne...gateway-card-skimmer-via-fake-google-domains/

Attackers are using fake Google domains spoofed with the help of internationalized domain names (IDNs) to host and load a Magecart credit card skimmer script with support for multiple payment gateways.

"Our investigation revealed that the site had been infected with a credit card skimmer loading JavaScript from the malicious internationalized domain google-analytîcs[.]com (or xn--google-analytcs-xpb[.]com in ASCII)," Sucuri's research team found.
Internationalized domain names used as a C2 cover
Using IDNs to camouflage servers hosting malicious content is a known threat actor tactic employed during phishing attacks or, as this campaign shows, in attempts to conceal traffic coming from malicious domains as packets being delivered from legitimate sites.
Support for dozens of payment gateways
As the Sucuri researchers also discovered as part of their analysis, this Magecart skimmer script also comes with support for dozens of payments gateways, something that might connect it to another similar malicious tool discovered by Sanguine Security researcher Willem de Groot a couple of months ago.
Click to expand...

Sucuri: Fake Google Domains Used in Evasive Magento Skimmer

guest · Aug 1, 2019

PCI Council & Retail ISAC Issue Magecart Warning
August 1, 2019
https://www.infosecurity-magazine.com/news/pci-isac-magecart/

The PCI Security Standards Council and Retail and Hospitality ISAC have joined forces to highlight the growing threat of online skimming attacks, such as Magecart.

“These attacks infect e-commerce websites with malicious code, known as sniffers or JavaScript sniffers and are very difficult to detect,” an alert stated. “Once a website is infected, payment card information is ‘skimmed’ during a transaction without the merchant or consumer being aware that the information has been compromised.”
The alert warned that any e-commerce implementation that does not have effective security controls in place is potentially vulnerable.

Kizzee said: “The bulletin we are jointly issuing today should be a call to action to those in the business community to enhance their awareness of and vigilance against these techniques. No one should presume that they couldn’t or won’t be used to target their enterprise.
Click to expand...

guest · Aug 1, 2019

No summer break for Magecart as web skimming intensifies
August 1, 2019
https://blog.malwarebytes.com/web-t...eak-for-magecart-as-web-skimming-intensifies/

This summer, you are more likely to find the cybercriminal groups Magecart client-side rather than poolside.
65K theft attempts blocked in July
During the past few months, we have been observing a growing number of blocks related to skimmer domains and exfiltration gates. This activity drastically increased as the summer rolled out, most notably with peaks around July 4 (Figure 1).
In the month of July alone, Malwarebytes blocked over 65,000 attempts to steal credit card numbers via compromised online stores. Fifty-four percent of those shoppers were from the United States, followed by Canada, with 16 percent and Germany with 7 percent, as seen in Figure 2.

We often get asked how consumers can protect themselves from Magecart threats. Generally speaking, it’s better to stick to large online shopping portals rather than smaller ones. But, this piece of advice hasn’t always held true in the past.
Click to expand...

guest · Aug 9, 2019

National Baseball Hall of Fame Hit By Payment Card Stealing Attack
August 7, 2019
https://www.bleepingcomputer.com/ne...-of-fame-hit-by-payment-card-stealing-attack/

The web site for the National Baseball Hall of Fame in Cooperstown, NY was hacked to include a malicious MageCart script that stole the payment information of customers who purchased items on the site.
According to a notification filed with California's security breach notification service, the National Baseball Hall of Fame's web site had a malicious script injected into their online store between November 15, 2018 and May 14, 2019.

"The National Baseball Hall of Fame (“Hall of Fame”) values and respects the privacy of your information, which is why we are writing to advise you of a recent incident that may have involved some of your personal information," the notification alerted affected users.
It should be noted that this attack only affected customers who purchased items from the web site and not in the museum itself.
Payment information stolen by a MageCart attack
Attackers gained access to the Hall of Fame's web site and injected a malicious script on the site that would monitor for submitted payment information and then forward it to the attackers.
Click to expand...

guest · Aug 20, 2019

Magecart criminals caught stealing with their poker face on
August 20, 2019
https://blog.malwarebytes.com/threat-analysis/2019/08/magecart-criminals-caught-stealing-poker-face/

Typically, skimmers such as those used by Magecart criminals operate within the web browser by using malicious bits of JavaScript to steal personal details, including payment data, from victims. In this blog, we review the curious poker case that started with a detection for a Windows program but was also tied to a website compromise.
Software application connects to Magecart domain
Poker Tracker is a software suite for poker enthusiasts that aims to help players improve their game and make the online gaming experience smoother.
Every time users were launching PokerTracker 4, it would load the compromised web page within the application, which would trigger a block notification from Malwarebytes as the skimming script attempted to load. However, it’s worth noting that users going directly to the poker website were also exposed to the skimmer.

We reported this incident to the owners of PokerTracker and they rapidly identified the issue and removed the offending Drupal module. They also told us that they tightened their Content Security Policy (CSP) to help mitigate future attacks via harmful external scripts.
Click to expand...

What this incident tells us is that users might encounter web skimmers in unexpected locations—and not just in online shopping checkout pages. At the end of the day, anything that will load unvalidated JavaScript code is susceptible to being caught in the crosshairs. As a result, the Magecart robbers have a nice, wide playing field in front of them.
Click to expand...

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches