Magecart Attacks Grow Rampant in September

guest · Aug 26, 2019

Five strategies to stop Magecart
August 26, 2019
https://www.scmagazine.com/home/opinion/executive-insight/five-strategies-to-stop-magecart/

For decades, companies focused their security budgets heavily on protecting their servers against intruders. Everything inside the firewall became sacred ground, especially after GDRP brought forward record-breaking fines for data breaches.
But the past months brought forward a new threat that is catching small and large corporations alike unprepared: Magecart.

The recent British Airways $240 million fine following a Magecart attack put companies on alert. Now they are seeking to learn what they can do today to prevent these attacks, as protecting the server and its periphery are not enough. Within this scope, we can highlight five major steps enterprises can take now towards mitigating Magecart web supply chain attacks. [...]
Click to expand...

guest · Aug 28, 2019

Looking deep into Magecart
August 28, 2019
https://betanews.com/2019/08/28/magecart-research/

This research follows the trail of servers compromised by Magecart groups, as well as the collection servers to which the sites were actively sending stolen credit card data, in an effort to examine commonalities between victim websites and the tactics, techniques, and procedures used to compromise the servers.
Arxan and Aite Group have also worked with federal law enforcement to notify the 80 victim sites discovered during this research as well as the staging sites used by the Magecart groups to collect the stolen data.

"It looks like around 4,800 sites are compromised every month, some due to outdated or vulnerable versions of eCommerce platforms, some due to other vulnerabilities that have allowed the attacker to place code on a server. A third path is supply chain attacks as applications may be composed of many third-party components."

"Companies must realize that there's an attack surface in the hands of the customer," adds Lint. "What happens in the browser needs to be part of an application security strategy for an organization. There's really no excuse in this day and age not to consider that as part of your overall threat matrix."
Click to expand...

Arxan: In Plain Sight II: On the Trail of Magecart

guest · Sep 12, 2019

Garmin SA Shopping Portal Breach Leads to Theft of Payment Data
September 12, 2019
https://www.bleepingcomputer.com/ne...portal-breach-leads-to-theft-of-payment-data/

Garmin Southern Africa (Garmin SA) disclosed today in a series of notifications sent to its customers that payment and sensitive personal information were stolen from orders placed on the shop.garmin.co.za shopping portal.
Payment info including CVV codes stolen
"We recently discovered theft of customer data from orders placed through shop.garmin.co.za (operated by Garmin South Africa) that compromised your personal data related to an order that you placed through the website," said Jennifer Van Niekerk, South Africa Managing Director.
"As a valued customer, we apologize for this incident and assure you that Garmin takes our obligation to safeguard personal data very seriously," added Van Niekerk.
Possible Magecart skimming incident
"While the cause is not mentioned, the kind of stolen data (typical checkout form fields) and the CMS (Magento) sound like a Magecart skimmer," said Malwarebytes security researcher Jérôme Segura. [...] — Jérôme Segura (@jeromesegura) September 12, 2019
Click to expand...

guest · Sep 18, 2019

Magecart Skimming Attack Targets Mobile Users of Hotel Chain Booking Websites
September 18, 2019
https://blog.trendmicro.com/trendla...mobile-users-of-hotel-chain-booking-websites/

We discovered a series of incidents where the credit card skimming attack Magecart was used to hit the booking websites of chain-brand hotels — the second time we’ve seen a Magecart threat actor directly hit ecommerce service providers instead of going for individual stores or third-party supply chains.
The credit card skimmer is designed to steal data from payment forms. The skimmer hooks its function to the JavaScript events “submit” and “click,” which are usually triggered when people submit a payment or a booking.
Magecart replaces the original booking page with a fake one
Although the skimmer itself is not unique, we found that it removes the original credit card form on the booking page and injects another one prepared by the threat actor. We theorize two possible reasons for this.

The first is [...] To ensure that all credit card information are captured, the attacker replaces the original form with one that contains the CVC number column.
The second possible reason is that, sometimes, the booking page will host the credit card form in a different domain using an HTML iframe element to make it more secure. In this scenario, a regular JavaScript skimmer will not be able to copy the data inside the secure iframe.
Click to expand...

Conclusion
Recent incidents involving credit card skimmers like Magecart emphasize the need for businesses to secure their websites from potential compromise by implementing security best practices, which include regularly updating software to the latest versions and segregating networks to ensure that as little customer data as possible is exposed.

Furthermore, users can consider using payment systems such as Apple Pay and Google Pay, which offer additional authentication methods — minimizing the chance that attackers will be able to use the credit card even if they manage to collect the card’s details.
Click to expand...

guest · Sep 20, 2019

Sinkholed Magecart domains resurrected for advertising schemes
September 20, 2019
https://searchsecurity.techtarget.c...rt-domains-resurrectedfor-advertising-schemes

Sinkholed Magecart domains previously used for payment card skimmers could pose new threats such as ad fraud and malvertising.

In a blog post, Yonathan Klijnsma, head of threat research at RiskIQ, explained that registrars often put domains up for sale again after they have been taken down due to malicious activity.

"Here's the catch: when these domains come back online, they retain their call-outs to malicious domains placed on breached websites by attackers, which means they also retain their value to threat actors," Klijnsma wrote in the blog post.
But the purchasers of these Magecart domains went a step further, Klijnsma said. The threat actors took advantage of the malicious JavaScript the Magecart cybercriminals previously used to call out to their skimmers, though instead of downloading skimmers the JavaScript now injects ads. In addition, the revised JavaScript contains another remote script that counts traffic to the domains.

Klijnsma said the new threat actors can't "play the ignorance card"; they wouldn't use the exact same file path as the Magecart skimmers and then log the traffic to the domains unless they knew what the domains had been used for previously and were aware of how to monetize them, he said.
Click to expand...

guest · Sep 24, 2019

Singapore payment card data compromised by JavaScript sniffers
September 24, 2019
https://www.computerweekly.com/news...-card-data-compromised-by-JavaScript-sniffers

The payment card information belonging to thousands of customers of Singapore banks was believed to have been compromised by a type of web-based malware and put up for sale on the dark web, according to Singapore-based cyber security company Group-IB.

During their analysis of underground card shops, Group-IB’s threat hunting team discovered a spike in the sale of raw data of 4,166 compromised payment cards – including CVV, card number and expiration date – issued by Singapore banks.
The data was likely to have been stolen using JavaScript sniffers, the online equivalent of a traditional card skimmer – a small device installed on ATMs that intercepts payment card details, said Group-IB.

“In order to minimise losses, in case an online store is infected with a JavaScript sniffer, we advise online shoppers in Singapore not to keep all their eggs in one basket and have a separate pre-paid card for online payments or even a separate bank account exclusively for online purchases,” said Sachkov.
Click to expand...

Group-IB: JavaScript-sniffers knock on Singapore’s door

guest · Sep 24, 2019

Malware Attack Prompts US Transport Authority to Axe Online Store
September 24, 2019
https://www.infosecurity-magazine.com/news/us-transport-authority-online-store/

An American transport authority has responded to a malware attack by permanently closing its online store.

The Southeastern Pennsylvania Transport Authority (SEPTA) shuttered the site Shop.SEPTA.org within an hour of discovering that the personal data of 761 customers had been stolen in a data-skimming Magecart attack.
Hackers were able to steal shoppers' credit card numbers, names, and addresses during an online crime spree thought to have begun on June 21 and ended on July 16.

The revelation that the online store had been permanently closed in an effort to prevent any future malware attacks only came to light on September 19 when it was reported by The Philadelphia Inquirer.

Explaining SEPTA's arguably extreme approach to cybersecurity, Busch told Infosecurity Magazine: "The primary reason for shutting it down was to eliminate the potential for any additional customer information to be compromised.
Click to expand...

guest · Sep 25, 2019

Magecart skimmers seen targeting routers for customer Wi-Fi networks
Web-skimming malware makers appear to be testing attacks against layer 7 routers
September 25, 2019
https://arstechnica.com/information...argeting-routers-for-customer-wi-fi-networks/

Threat researchers at IBM X-Force IRIS have spotted activity by a known group of criminal Web malware operators that appears to be targeting commercial layer 7 routers—the type typically associated with Wi-Fi networks that use "captive portals" to either charge for Internet access or require customers to sign in.

The group, called "Magecart 5," is one of several factions of criminal groups originally associated with the Magecart "web-skimmer," a class of JavaScript-based payment card stealing malware that has been used in the past to target customers on e-commerce websites.
Now you're playing with captive portals
The activity picked up by X-Force IRIS researchers shows Magecart 5 going in a whole new direction for JavaScript injection attacks. The type of routers that the group is focusing on—a specific type of router commonly used to provide free or paid Wi-Fi Internet access at airports, hotels, resorts, and even in some retail environments—use captive portals to process payments for access, agree to terms of service, and often to display advertisements.
Click to expand...

IBM X-Force: Leading Magecart Group Targeting Captive Wi-Fi Users via L7 Routers

guest · Sep 27, 2019

The Consumer Guide to Shopping Safely in the Age of Magecart
September 25, 2019
https://www.riskiq.com/blog/external-threat-management/consumer-shopping-guide-magecart/

For the last ten years, the e-commerce industry has been battling a stealthy enemy in digital web skimming. Dubbed Magecart by RiskIQ when we first reported on the threat, these groups of cybercriminals have been intercepting credit card information from users making purchases online by breaching websites and injecting their Javascript web skimmers on checkout pages.

While the onus is very squarely on businesses to protect their customers by increasing their visibility into the code running on their websites, Magecart is only growing more prevalent. In the meantime, consumers can take precautions to avoid being victimized and having their credit card information feed this criminal enterprise.
Yonathan Klijsnma, RiskIQ’s Head Threat Researcher and the leading expert on Magecart, offers five tips you can take as an online shopper to stay safe.
Click to expand...

guest · Sep 28, 2019

Fragrance Direct discovers 'malicious code' that led to leakage of customer data
September 27, 2019
https://www.theregister.co.uk/2019/09/27/online_perfume_merchant_hacked

Online merchant fragrancedirect.co.uk has confirmed a miscreant broke into its systems and made off with a raft of customers’ personal data, including payment card details.

The e-retailer, based in Macclesfield, England, wrote to punters this week to inform them of the digital burglary and the subsequent data leakage.

“We recently discovered that some of our user data may have been compromised as a result of unauthorised access to our website by a malicious third party,” the email states.
It added that “Fragrance Direct Username and Password”, along with “Name, Address and Phone Number”, and “Credit and Debit Card Details” spilled into the wrong hands.
The Information Commissioner’s Office told us that “Fragrance Direct has reported an incident to us and we will assess the information provided”.
Click to expand...

We will update this article when the business replies. We suspect it was a card-stealing MageCart infection.
Click to expand...

guest · Oct 3, 2019

Evidence tying Cobalt Group to Magecart Group 4 unveiled
October 3, 2019
https://www.scmagazine.com/home/sec...ng-cobalt-group-to-magecart-group-4-unveiled/

The security firms Malwarebytes and HYAS have strung together several pieces of evidence that they believe tie Magecart Group 4 to the Cobalt Group.

The two companies found that the Cobalt Group and Magecart Group 4 have several overarching similarities, such as the use of advanced techniques during their attacks and a history with banking malware. Additionally, the research firms found some underlying stylistic parallels that serve as circumstantial evidence that the two are the same entity.
Malwarebytes found connections between email registrants and exfiltration gates.

“By checking their exfiltration gates (secure.upgradenstore[.]com and secureqbrowser[.]com), we connected them to other registrant emails and saw a pattern emerge. Email addresses used to register Magecart domains belonging to Magecart Group 4 contain a [first name], [initial], and [last name],” Malwarebytes said.
For the final piece of the puzzle, Malwarebytes considered the fact that other cybergangs in the same class as Cobalt Group, such as Fin6, have entered the Magecart space, so it is only logical that Cobalt would do so as well in order to diversity its criminal portfolio.
Click to expand...

Malwarebytes: Magecart Group 4: A link with Cobalt Group?

guest · Oct 4, 2019

Virus Bulletin 2019: Magecart Infestations Saturate the Web
There are dozens of known groups, hundreds of C2 servers and millions of victim websites
October 4, 2019
https://threatpost.com/magecart-infestations-saturate-web/148911/

Magecart, the digital card-skimming collective, is now so ubiquitous that its infrastructure is flooding the internet. In a paper presented at Virus Bulletin 2019 this week in London, Jordan Herman and Yonathan Klijnsma of RiskIQ said that there are now 573 known C2 domains for the group, with close to 10,000 hosts actively loading those domains.

In all, RiskIQ has detected almost 2 million (2,086,529) instances of Magecart’s javaScript binaries, with over 18,000 hosts directly breached.
And, adding insult to injury, because Magecart skimmers stay on websites for so long, if not indefinitely, they can be a second-hand boon to threat actors, researchers said: Markets for skimmers and pre-breached websites are making the barriers to entry extremely low for new Magecart actors.

“Large portions of malicious Magecart domains have been taken up for sinkholing by various parties,” explained Herman and Klijnsma. “However, some of them are kicked offline by the registrar, put on hold and eventually released back into a pool of available domains. RiskIQ researchers have noticed bad guys taking advantage of these domains coming back up for sale and buying them [...]”
Click to expand...

RiskIQ: Magecart: The State of a Growing Threat

guest · Oct 10, 2019

Akamai Snaps Up ChameleonX to Tackle Magecart
October 10, 2019
https://www.darkreading.com/cloud/akamai-snaps-up-chameleonx-to-tackle-magecart/d/d-id/1336058

Akamai has confirmed plans to acquire ChameleonX, an Israel-based security startup with a strong focus on securing websites against attacks targeting payment and personal information.

The goal is to accelerate development of a tool to protect websites from Magecart attacks, an increasingly common threat in which adversaries inject malicious code into a target website so they can steal credential and payment card data at checkout. ChameleonX's platform is designed to detect this code on a victim system early on, before significant damage is done.
ChameleonX was founded in 2016 and has since generated $1.9 million over two rounds of funding. Terms of the deal were not disclosed;
Click to expand...

Akamai: Akamai Technologies Accelerates Development Of Solution To Protect Websites From Magecart And Credit Card Skimming With Planned Acquisition Of ChameleonX

guest · Oct 22, 2019

Magecart 5 Linked to Carbanak Gang
The Magecart splinter group known for supply-chain attacks appears to be tied to advanced threat actors
October 22, 2019
https://threatpost.com/magecart-5-linked-carbanak-gang/149419/

Researchers have linked Magecart Group 5, the credit-card skimming cybercriminals behind the Ticketmaster breach, to Dridex phishing campaigns and the infamous Carbanak group.

Magecart 5 specifically targets the supply-chain used by e-commerce merchants; in the Ticketmaster attack for instance, it targeted a chat feature hosted by a third party. It’s a bang-for-the-buck strategy that potentially gives it access to hundreds or even thousands of websites downstream.

“This kind of supply-chain attack, where thousands of stores are loading altered code, have a much higher return than individually targeting stores,” explained researchers at Malwarebytes, in an analysis on Tuesday.
It’s worth noting that Magecart 5 also uses a higher-end toolset, in the form of various libraries, analytics and fake “security seals” meant to reassure website visitors that the site is malware-free.
Links to Carbanak

“We spent some time digging into a number of Magecart domains registered via the well-known Chinese registrar BIZCN/CNOBIN, [which is] essentially a bulletproof registrar,” Malwarebytes researchers said. “We narrowed down the domains to a smaller subset previously identified as being used by Magecart Group 5.”
Click to expand...

Malwarebytes: The forgotten domain: Exploring a link between Magecart Group 5 and the Carbanak APT

guest · Oct 25, 2019

P&G Online Beauty Store Hacked to Steal Payment Info
October 25, 2019
https://www.bleepingcomputer.com/ne...ne-beauty-store-hacked-to-steal-payment-info/

Hackers in May planted an e-skimmer on Procter & Gamble's site First Aid Beauty and it was still stealing payment card data today. This particular MageCart script selects its victims from the US.
If a shopper is from a different country or uses Linux operating system, the script remains inactive, most likely as a defense against security researchers.
Company did not react for about a week
Willem de Groot, a researcher at Sanguine Security that tracks online payment skimming and fraud, found that the malicious script has been hiding on the First Aid Beauty website since May 5.
It is unclear how many visitors shop from First Aid Beauty but the site has had around 100,000 monthly visitors in the past six months, around %80 of them being from the U.S.

de Groot told us that website owners typically discover these skimmers withing a couple of weeks but this one resisted for more than five months, "so the level of stealth for this actor is outstanding."
Click to expand...

Update [10/25/2019]: A few minutes after publishing we checked the website again and it was back up without the malicious script. The fact that e-skimmer survived undetected for such a long time is a concern that the company should address.
Click to expand...

guest · Oct 28, 2019

Sixth June Fashion Site Hacked to Steal Credit Cards
October 28, 2019
https://www.bleepingcomputer.com/news/security/sixth-june-fashion-site-hacked-to-steal-credit-cards/

French fashion online store Sixth June is offering shoppers more than the latest in men and women streetwear apparel as the site was infected some time ago with code that steals payment card info at checkout.
The infosec community typically refers to this type of scripts as MageCart because they initially targeted sites using the Magento e-commerce platform.
Almost a week of thieving
In September, the site had about 70,000 monthly visitors. The brand relies on the Magento e-commerce platform for online sales and also has five brick and mortar stores in different cities in France.
The code stealing Sixth June customers' payment info was still loading on the checkout page at the time of writing. Security researcher Jenkins (https://twitter.com/jknsCo) found the malicious script and notified the company CEO last week but never got a reply.

We reported the hack to their CEO last week but have not yet received a response. pic.twitter.com/EZuZpkgxYX
— Jenkins (@jknsCo) October 28, 2019
Click to expand...

guest · Nov 5, 2019

Magecart Groups Attack Simultaneous Sites in Card-Theft Frenzy
November 4, 2019
https://threatpost.com/magecart-groups-attack-simultaneous-sites-in-card-theft-frenzy/149872/

In an interesting development on the financial cybercrime scene, different Magecart groups have been spotting stepping over each other and attacking the same sites.

According to research from PerimeterX, multiple Magecart attacks are skimming credit cards from sites at the same time. These don’t seem to be coordinated, according to the firm, given that each of the attacks were different in terms of the techniques used to compromise the target retailers.

“From we’ve learned so far, this is a cybercrime-as-a-service operation where multiple groups operate and breach websites, Magento-based and others, and they use different skimming kits purchased on the Dark Web,” he told Threatpost.
Multiple Skimmer Discovery
In researching recent Magecart attacks on clothing e-shop Sixth June that came to light last week, PerimeterX researchers found the Sixth June skimmed data being posted to a domain [...] Further investigation showed that PEXSuperstore was also infected with a second Magecart skimmer [...]

“The two skimmers were completely different from each other in terms of code, obfuscation level and complexity,” explained PerimeterX research lead Mickey Alton, in a posting on Monday.
Click to expand...

PerimeterX: PerimeterX Research Team Uncovers New Trend in Magecart Attacks: Multiple Magecart Groups Attacking Simultaneously

guest · Nov 18, 2019

Macy's Customer Payment Info Stolen in Magecart Data Breach
November 18, 2019
https://www.bleepingcomputer.com/ne...-payment-info-stolen-in-magecart-data-breach/

Macy's has announced that they have suffered a data breach due to their web site being hacked with malicious scripts that steal customer's payment information.
This type of compromise is called MageCart attack and consists of hackers compromising a web site so that they can inject malicious JavaScript scripts into various sections of the web site.

According to a 'Notice of Data Breach' issued by Macy's, their web site was hacked on October 7th, 2019 and a malicious script was added to the 'Checkout' and 'My Wallet' pages. If any payment information was submitted on these pages while they were compromised, the credit card details and customer information was sent to a remote site under the attacker's control.
As part of this breach, attackers were able to access customer information and credit card information that includes the customer's first name, last name, address, city, state,zip, phone number, email address, payment card number, payment card security code, and payment card month/year of expiration if submitted on a compromised page.
Click to expand...

guest · Nov 21, 2019

Card Skimmer Group Replaces Checkout Page to Steal Payment Info
November 21, 2019
https://www.bleepingcomputer.com/ne...replaces-checkout-page-to-steal-payment-info/

A payment service platform's checkout page was recently cloned by the threat actors behind a web skimming campaign that harvested and stole credit card information from an online shop's customers.

The e-skimming campaign observed by Malwarebytes Director of Threat Intelligence Jérôme Segura didn't bother with trying to scrape the info entered by buyers into the store's forms but went straight to the PSP, effectively replacing its checkout page with a cloned one to intercept and collect the shoppers' credit card data.

The fraudsters took things a step further since, as Segura observed, they also added data validation capabilities to their phishing form, alerting their victims to enter the correct data if anything was out of order.
Escalating attacks against PSPs
This is not the first time skimmers messed around with PSPs but it never at this level, as the attackers have never created fake pages to replace legitimate PSP ones.
Click to expand...

guest · Nov 26, 2019

Fullz House hackers pivot from phishing to Magecart card skimming attacks
However, they aren’t very good at hiding their tracks
November 26, 2019
https://www.zdnet.com/article/fullz...m-phishing-to-magecart-card-skimming-attacks/

Card-skimming schemes, also known as Magecart attacks, have become a common threat in a world dominated by e-commerce.
[...] a recent spate of Magecart campaigns has highlighted, even well-known companies and organizations can fall prey if they fail to keep a close eye on their payment portals and patching processes.

On Tuesday, RiskQ published a report into the activities of Fullz House and recent changes to their modus operandi.
Fullz House used to specialize in phishing but have now decided to double-dip by bringing its skills from the phishing ecosystem into the world of card-skimming.
[...] the cybercriminals have written their own skimmer code -- something that RiskIQ says is now a rare occurrence.

"The Fullz group crossed over from the phishing ecosystem to bring an entirely new skill set to the online skimming game," RiskIQ says.
Click to expand...

RiskIQ: Full(z) House: a digital crime group using a full deck to maximize profits

guest · Dec 2, 2019

Smith & Wesson Web Site Hacked to Steal Customer Payment Info
December 2, 2019
https://www.bleepingcomputer.com/ne...b-site-hacked-to-steal-customer-payment-info/

American gun manufacturer Smith & Wesson's online store has been compromised by attackers who have injected a malicious script that attempts to steal customer's payment information.

According to Sanguine Security's Willem de Groot, a Magecart group has been registering domain names named after his company and utilizing his name as the domain contact.
When researching this group and other sites that they have compromised, de Groot discovered that the web site for Smith & Wesson had been compromised some time before Black Friday to include a similar script from this group.

For most of the site, the loaded JavaScript file looks like a normal 11KB and non-malicious script.
However if you are using a US-based IP address, non-Linux browsers, not on the AWS platform, and at the checkout page, the script being delivered changes from 11KB to 20KB, with the Magecart portion appended to the bottom as shown below.
Click to expand...

If you have recently shopped at smith-wesson.com and entered payment information, you need to contact your credit card company and monitor your statements for suspicious or fraudulent charges.
Click to expand...

guest · Dec 4, 2019

UK Retailer Sweaty Betty Hacked to Steal Customer Payment Info
December 4, 2019
https://www.bleepingcomputer.com/ne...-betty-hacked-to-steal-customer-payment-info/

The web site for UK activewear retailer Sweaty Betty has been hacked to insert malicious code that attempts to steal a customer's payment information when making purchases.

In emails being sent to Sweaty Betty customers, the retailer states that customers shopping online between November 19th, 2019, at 6:24 PM (GMT) and November 27th, 2019, at 2:52 PM (GMT) may have had their credit card or debit card details stolen.

"These investigations confirmed that a third party gained unauthorised access to part of our website and inserted malicious code designed to capture information entered during the checkout process. [...]"
The notification goes on to say that those customer's who paid with a credit or debit card during the time of the hack would have had their name, Sweaty Betty password, billing address, delivery address, email address, telephone number, payment card number, CVV number, and expiry date stolen.
Furthermore, Sweaty Betty states that customers making purchases using PayPal or Apple Pay were not affected.
Click to expand...

guest · Dec 4, 2019

Salesforce’s Heroku Used to Host Magecart Skimmers, Stolen Cards
December 4, 2019
https://www.bleepingcomputer.com/ne...-used-to-host-magecart-skimmers-stolen-cards/

Magecart threat actors have been spotted this week while starting to abuse Salesforce's Heroku cloud application platform to host their card skimming scripts and to store stolen payment card info.
Heroku is a cloud platform-as-a-service (Paas) designed to help companies and individual developers to speedily build and host web apps without having to worry about also managing the infrastructure behind them.
Heroku used and abused
The threat actors took advantage of the Heroku freemium model that allowed them to use the platform as a free web hosting service for their skimming operations after registering a free account.
The rogue iframe displayed by the malicious web app over the payment forms is identical to the originals and it is designed to collect the customers' credit card information without their knowledge and without raising any red flags.

Once it successfully harvests a user's card info, the stolen data will be automatically sent back to the Magecart skimmer web app's storage space on Heroku in encoded format.

"Finally, the stolen data is exfiltrated, after which victims will receive an error message instructing them to reload the page," Malwarebytes' researchers found. "This may be because the form needs to be repopulated properly, without the iframe this time."
Click to expand...

Malwarebytes: There’s an app for that: web skimmers found on PaaS Heroku

guest · Dec 12, 2019

Hundreds of Counterfeit Sneaker Sites Hacked to Steal Credit Cards
December 12, 2019
https://www.bleepingcomputer.com/ne...t-sneaker-sites-hacked-to-steal-credit-cards/

As the craze for the latest Off-White, Nike, and Adidas sneakers heats up, sites selling counterfeit kicks have popped up to capitalize on sneakerheads searching for the best deal. To make a bad deal even worse, hackers are now targeting these sites to install malicious Magecart scripts that also steal your credit card information.

In a new report, Malwarebytes has discovered a large-scale hacking operation that is targeting these counterfeit sneaker sites and infecting them with malicious scripts to steal shopper's credit cards.

"We recently identified a credit card skimmer injected into hundreds of fraudulent sites selling brand name shoes. Unfortunate shoppers may not only be disappointed with the faux merchandise, but they will also relinquish their personal and financial data to Magecart fraudsters."
According to Malwarebytes, the hackers are injecting a malicious script named translate.js into these sneaker sites.
After analyzing all of the sites that were compromised, it became clear to Malwarebytes threat intelligence researcher Jérôme Segura that all of the sites shared something in common.
Click to expand...

Malwarebytes: Hundreds of counterfeit online shoe stores injected with credit card skimmer

guest · Dec 13, 2019

Attackers Steal Credit Cards in Rooster Teeth Data Breach
December 13, 2019
https://www.bleepingcomputer.com/ne...al-credit-cards-in-rooster-teeth-data-breach/

Rooster Teeth Productions have suffered a data breach that allowed attackers to steal credit card and other payment information from shoppers on the company's online store.
The production company, known for its popular shows and documentaries such as RTDocs, Crunch Time, Red vs. Blue, gen:LOCK, and Day 5, suffered an attack that redirected shoppers to a fake payment form on checkout.

According to a data breach notification, Rooster Teeth discovered on December 2nd that their online store was hacked earlier that day. As part of this hack, a malicious script was injected into the store that would cause the shopper to be redirected to a fake payment page under the control of the attackers.
Not a common Magecart attack
Yonathan Klijnsma of RiskIQ told BleepingComputer that Rooster Teeth was affected by an attack similar to ones that were recently disclosed in the researcher's Full(z) House: a digital crime group report.
Click to expand...

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches