Pipka JavaScript Skimmer Deletes Itself After Execution

guest · Nov 17, 2019

Pipka JavaScript Skimmer Deletes Itself After Execution
November 15, 2019
https://hotforsecurity.bitdefender....mer-deletes-itself-after-execution-21777.html

Visa has identified a new type of JavaScript skimmer in the wild that can erase itself from HTML code after execution.

The malware, named Pipka, was found running on several eCommerce websites in the United States. While the basic working principle behind this JavaScript skimmer is not new, its ability to delete itself after execution caught the attention of security professionals.

“The most interesting and unique aspect of Pipka is its ability to remove itself from the HTML code after it is successfully executed. This enables Pipka to avoid detection, as it is not present within the HTML code after initial execution,” says Visa.
Moreover, Pipka is not a proof of concept. It was already running in the wild when the researchers from Visa Payment Fraud Disruption’s (PFD) eCommerce Threat Disruption (eTD) program found it. Which only means that it might be more widespread.
Click to expand...

Visa Security Alert - New JavaScript Skimmer ‘Pipka’ Targeting eCommerce Merchants Identified
(PDF - 288 KB): https://usa.visa.com/dam/VCOM/global/support-legal/documents/pfd-identifies-new-javascript-skimmer.pdf

Rasheed187 · Nov 23, 2019

This is cool and stuff, but aren't they (Visa) basically admitting that paying with creditcards on the web is still not safe after 20 years? Why aren't they trying to fix that?

guest · Sep 7, 2020

mood said: ↑

Pipka JavaScript Skimmer Deletes Itself After Execution November 15, 2019

Visa Security Alert - New JavaScript Skimmer ‘Pipka’ Targeting eCommerce Merchants Identified
(PDF - 288 KB): https://usa.visa.com/dam/VCOM/global/support-legal/documents/pfd-identifies-new-javascript-skimmer.pdf
Click to expand...

...same technique used by "Baka":

Visa warns of new sophisticated credit card skimmer dubbed Baka
September 6, 2020
https://securityaffairs.co/wordpress/107965/malware/card-e-skimmer-baka.html

Visa issued a warning regarding a new e-skimmer known as Baka that removes itself from memory after having exfiltrating payment card details.

The e-skimmer was first spotted by experts with Visa’s Payment Fraud Disruption (PFD) initiative in February 2020 while analyzing a command and control (C2) server employed in another campaign and that hosted an ImageID e-skimming kit.
Baka is a sophisticated e-skimmer developed by a skilled malware developer that implements a unique obfuscation method and loader.

“PFD assesses that this skimmer variant avoids detection and analysis by removing itself from memory when it detects the possibility of dynamic analysis with Developer Tools or when data has been successfully exfiltrated.”
PFD experts found the Baka skimmer on several merchant websites across the world that are using Visa’s eTD capability.
Click to expand...

Baka is also the first JavaScript skimming malware to use an XOR cipher to encrypt hard-coded values and obfuscate the skimming payload delivered by the command and control.
The alert includes Indicators of Compromise and the following list of best practices and mitigation measures: [...]
Click to expand...

Visa Security Alert - ‘Baka’ JavaScript Skimmer Identified
(PDF - 875 KB): https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/visa-security-alert-baka-javascript-skimmer.pdf

Log in or Sign up

Pipka JavaScript Skimmer Deletes Itself After Execution

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Pipka JavaScript Skimmer Deletes Itself After Execution

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches