Magecart Attacks Grow Rampant in September

guest · Dec 23, 2021

Pro Wrestling Tees discloses data breach after credit cards stolen
December 23, 2021

Popular wrestling t-shirt site Pro Wrestling Tees has disclosed a data breach incident that has resulted in the compromise of the financial details of tens of thousands of its customers.

Pro Wrestling Tees is a website allowing professional wrestlers to set up their own mini-stores to sell merchandise like shirts, posters, action figures, and more to their fans.
Click to expand...

The entity informed the Office of the Maine Attorney General about the incident on December 22, 2021, saying the incident affected 31,000 customers.

"We immediately conducted an extensive investigation of our system and concluded that a malware virus was the source of breach," reads the Pro Wrestling Tees data breach notification.
The credit cards were stolen due to a malware infection that stole full names and credit card numbers along with the matching CVV codes.
While it is not clear how the cards were stolen, it was likely caused by their site being hacked and a malicious skimmer script added to steal credit cards during checkout.
Click to expand...

Unfortunately, some users on Reddit claim to have lost thousands of USD due to their credit cards being stolen, while others say their bank intervened and flagged fraudulent transactions.

This means that the details are already being exploited in the cyber-criminal underground, so utmost vigilance to all Pro Wrestling Tees customers is advised.
Click to expand...

guest · Jan 1, 2022

might be a Magecart attack:

PulseTV discloses potential compromise of 200,000 credit cards
December 31, 2021

U.S. online store PulseTV has disclosed a large-scale customer credit card compromise. As per the notification letter shared with the Office of the Maine Attorney General, more than 200,000 shoppers have been impacted.

The platform found out about a potential breach from VISA on March 8, 2021, who informed them that unauthorized credit card transactions were taking place on the site.
Click to expand...

On November 18, 2021, the investigators "learned that the website had been identified as a common point of purchase for a number of unauthorized credit card transactions for MasterCard."

“Based upon communications with the card brands, it is believed that only customers who purchased products on the website with a credit card between November 1, 2019 and August 31, 2021 may have been affected” - PulseTV
PulseTV customers that made purchases from the site during the specified breach period are recommended to keep a vigilant eye on their bank statements for unauthorized transactions.
Click to expand...

PulseTV claims that their investigations did not reveal a breach on their systems. They were the common point for multiple unauthorized transactions, though.
This makes it unclear if a well-hidden skimmer was planted on the website or the cards were stolen from other merchants and only used on PulseTV for shopping.
Click to expand...

PulseTV discloses potential credit card breach
January 1, 2022

At this time the company has yet to determine if it was the victim of a Magecart attack or the stolen card were only used on PulseTV for cash-out.
Click to expand...

guest · Jan 4, 2022

Skimmer Injected Into 100 Real Estate Websites via Cloud Video Platform
January 4, 2022

Increasingly popular, skimmer attacks involve the use of malicious JavaScript code to steal data provided by users on the targeted website.

As part of this recent campaign, Palo Alto Networks explains, skimmer code was injected into a video so that it was automatically embedded into websites that imported the video.
Click to expand...

The attack was possible because the abused cloud video platform allows users to add their own JavaScript customizations to players, by uploading a JavaScript file that is included in the player.

“We infer that the attacker altered the static script at its hosted location by attaching skimmer code. Upon the next player update, the video platform re-ingested the compromised file and served it along with the impacted player,” Palo Alto Networks notes.
Click to expand...

Highly obfuscated to hide its malicious purpose, the JavaScript code was designed to detect credit card patterns, verify the credit card numbers, and harvest the card data and send it to the attackers.

“The skimmer itself is highly polymorphic, elusive and continuously evolving. When combined with cloud distribution platforms, the impact of a skimmer of this type could be very large,” Palo Alto Networks says.
Click to expand...

Palo Alto Networks - Unit42: A New Web Skimmer Campaign Targets Real Estate Websites Through Attacking Cloud Video Distribution Supply Chain

Supply chain networks are frequent targets for cybercrime, as controlling a weak link in the supply chain can grant cybercriminals access to more victims – especially when the weak link is the source of the supply chain. Recently, we found a supply chain attack leveraging a cloud video platform to distribute skimmer (aka formjacking) campaigns.

In skimmer attacks, cybercriminals inject malicious JavaScript code to hack a website and take over the functionality of the site’s HTML form page to collect sensitive user information. In the case of the attacks described here, the attacker injected the skimmer JavaScript codes into video, so whenever others import the video, their websites get embedded with skimmer codes as well.
Click to expand...

guest · Jul 20, 2022

Hackers steal 50,000 credit cards from 300 U.S. restaurants
Magecart Serves Up Card Skimmers on Restaurant-Ordering Systems
July 19, 2022

Payment card details from customers of more than 300 restaurants have been stolen in two web-skimming campaigns targeting three online ordering platforms.
Web-skimmers, or Magecart malware, are typically JavaScript code that collects credit card data when online shoppers type it on the checkout page.

Recently, Recorded Future’s threat detection tools identified two Magecart campaigns injecting malicious code into the online ordering portals of MenuDrive, Harbortouch, and InTouchPOS.
Click to expand...

According to Recorded Future, both campaigns are ongoing, and their corresponding exfiltration domains are still online and operational.

The InTouchPOS infection is easier to catch with most security scanners, as it uses a JavaScript downloader for the skimmer, which can be detected through simple code comparison.
BleepingComputer has contacted all three platforms for a comment on these attacks and is currently waiting for a reply.
Click to expand...

Recorded Future: Amid Rising Magecart Attacks on Online Ordering Platforms, Recent Campaigns Infect 311 Restaurants

Online ordering platforms for restaurants enable customers to make online food orders and allow restaurants to outsource the burden of developing an ordering system.

As a result, online ordering platforms have become a high-value target for threat actors conducting Magecart e-skimmer attacks because compromising a single online ordering platform typically results in the exposure of online transactions performed at a significant portion of the restaurants that use the platform.
Click to expand...

To date, we have already identified over 50,000 compromised payment card records that were exposed from these infected restaurants and posted for sale on the dark web.
Click to expand...

guest · Sep 3, 2022

Researchers analyzed a new JavaScript skimmer used by Magecart threat actors
Researchers from Cyble analyzed a new, highly evasive JavaScript skimmer used by Magecart threat actors.
By Pierluigi Paganini - September 1, 2022

Cyble Research & Intelligence Labs started its investigation after seeing a post on Twitter a new JavaScript skimmer developed by the Magecart threat group used to target Magento e-commerce websites.

In Magecart attacks against Magento e-stores, attackers attempt to exploit vulnerabilities in the popular CMS to gain access to the source code of the website and inject malicious JavaScript. The malicious code is designed to capture payment data (credit/debit owner’s name, credit/debit card number, CVV number, and expiry date) from payment forms and checkout pages. The malicious code also performs some checks to determine that data are in the correct format, for example analyzing the length of the entered data.
Click to expand...

In this specific case, the researchers discovered that when a user visits the compromised website, the skimmer loads the payment overlay and asks the user to enter the payment information.
The skimmer is obfuscated and embedded in the JavaScript file “media/js/js-color.min.js”

Cyble experts noticed that upon executing the JavaScript, it checks if the browser’s dev tool is open to avoid being analyzed.
Click to expand...

“Online shopping activity is constantly on the rise due to its ease of use, digital transformation, and the sheer convenience. Skimmer groups continue to infect e-commerce sites in large numbers and are improving their techniques to remain undetected.” concludes the report. “Historically, Magento e-commerce websites have been the most highly targeted victims of skimmer attacks. While using any e-commerce website, ensure that you only use known and legitimate platforms.”
Click to expand...

Cyble: Highly Evasive Magecart JavaScript Skimmer Active In The Wild

Payment Data Stolen From Compromised Magento Sites
During our routine threat-hunting exercise, Cyble Research & Intelligence Labs (CRIL) came across a Twitter post wherein a researcher mentioned an interesting JavaScript skimmer created by the Magecart threat group (a consortium of malicious hacker groups who target online shopping cart systems) that steals payment information from the Magento e-commerce website.

Magecart is a wider term for several threat groups who compromise e-commerce websites and inject card-skimming scripts on checkout pages to steal customers’ payment details as well as their personal data.
Click to expand...

guest · Nov 17, 2022

Magento stores targeted in massive surge of TrojanOrders attacks
By Bill Toulas @billtoulas - November 16, 2022

At least seven hacking groups are behind a massive surge in 'TrojanOrders' attacks targeting Magento 2 websites, exploiting a vulnerability that allows the threat actors to compromise vulnerable servers.
Click to expand...

Website security firm Sansec warned that almost 40% of Magento 2 websites are being targeted by the attacks, with hacking groups fighting each other over control of an infected site.

These attacks are being used to inject malicious JavaScript code into an online store's website that can cause significant business disruption and massive customer credit card theft during a busy Black Friday and Cyber Monday period.
Click to expand...

The TrojanOrders attack
TrojanOrders is the name of an attack that exploits the critical Magento 2 CVE-2022-24086 vulnerability, allowing unauthenticated attackers to execute code and inject RATs (remote access trojans) on unpatched websites.

Adobe fixed CVE-2022-24086 in February 2022, but Sansec says many Magento sites still need to be patched.

"Sansec estimates that at least a third of all Magento and Adobe Commerce stores have not been patched so far," explains a new report by eCommerce cybersecurity firm SanSec.
Click to expand...

Sansec: Adobe Commerce merchants to be hit with TrojanOrders this season

Sansec Threat Research - November 15, 2022
At least seven Magecart groups are injecting TrojanOrders at approximately 38% of Magento and Adobe Commerce websites in November.
Click to expand...

guest · Jan 13, 2023

Researchers Find 'Digital Crime Haven' While Investigating Magecart Activity
By Jai Vijayan @jaivijayan - January 12, 2023

Cybercriminals engaged in one form of criminal activity can sometimes have their hands in a wide range of other nefarious campaigns as well, as researchers recently discovered when analyzing the infrastructure associated with a fresh iteration of a Magecart skimmer.
Click to expand...

Researchers from Malwarebytes recently observed a threat actor deploying a payment card skimmer — based on a framework called mr.SNIFFA — on multiple e-commerce sites. mr.SNIFFA is a service that generates Magecart scripts that threat actors can dynamically deploy to steal credit and debit card information from users paying for purchases on e-commerce websites. The malware is known for employing various obfuscation methods and tactics like steganography to load its payment card stealing code onto unsuspecting target websites.
Click to expand...

Sprawling Crime Haven
Their investigation of the infrastructure used in the campaign led to the discovery of a sprawling network of other malicious activities — including cryptocurrency scams, forums for selling malicious services, and stolen credit card numbers — that appeared linked to the same actor.

"Where one criminal service ends, another one begins — but often times they are linked," said Jerome Segura, director of threat intelligence at Malwarebytes, in a blog post summarizing the company's research. "Looking beyond snippets of code and seeing the bigger picture helps to better understand the larger ecosystem as well as to see potential trends."
Malwarebytes found the three domains hosted on infrastructure belonging to DDoS-Guard, a Russia-based bulletproof hosting company with a reputation for hosting shady websites and operations. The security vendor's investigation showed each of the three domains were associated with a wide range of other malicious activities.
Click to expand...

Malwarebytes: Crypto-inspired Magecart skimmer surfaces via digital crime haven

By Jérôme Segura - January 9, 2023
During one of our crawls, we spotted a skimmer using the 'Mr.SNIFFA' framework that targets e-commerce sites and their customers. In recent years, this skimmer has adopted various obfuscation techniques as well as steganography to load its malicious code and exfiltrate stolen credit card data. While Magecart threat actors usually pick domain names after third-party libraries, or Google Analytics, in this case they went with a crypto-inspired theme which we had not seen before.
Click to expand...

guest · Jan 14, 2023

Canada's largest alcohol retailer's site hacked to steal credit cards
By Sergiu Gatlan @serghei @serghei@mastodon.social - January 14, 2023

The Liquor Control Board of Ontario (LCBO), a Canadian government enterprise and the country's largest beverage alcohol retailer, revealed that unknown attackers had breached its website to inject malicious code designed to steal customer and credit card information at check-out.
Click to expand...

LCBO revealed on Wednesday that third-party forensic investigators found a credit card stealing script that was active on its website for five days.

"At this time, we can confirm that an unauthorized party embedded malicious code into our website that was designed to obtain customer information during the checkout process," LCBO said.
"Unfortunately, customers who provided personal information on our check-out pages and proceeded to our payment page on LCBO.com between January 5, 2023, and January 10, 2023, may have had their information compromised."
Click to expand...

While the malicious script was active on the retailer's website, the attackers could harvest various personal and financial information submitted by customers during the check-out process.

The company is still investigating the incident and is working on identifying all customers affected by this data breach.
Click to expand...

In web skimming (also known as Magecart) attacks like the one that affected LCBO's customers, threat actors inject JavaScript-based scripts known as credit card skimmers (aka Magecart scripts, payment card skimmers, or web skimmers) into compromised online stores designed to steal payment and personal information.
Click to expand...

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Magecart Attacks Grow Rampant in September

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches