29 July 2019

Magecart hackers use a new trick to pilfer credit card data

Magecart hackers use a new trick to pilfer credit card data

Sucuri research team has uncovered a new Magecart campaign that injects Magecart multi-gateway skimmer in fake Google domains in order to steal payment data when unaware visitors make transactions. The operation was detected when a Magento website owner had the site’s domain blacklisted by McAfee's SiteAdvisor service. The closer inspection revealed that the culprit was a JavaScript-based payment card skimmer embeded in the site.

“Our investigation revealed that the site had been infected with a credit card skimmer loading JavaScript from the malicious internationalized domain google-analytîcs[.]com (or xn--google-analytcs–xpb[.]com in ASCII). The malicious user purposely selected the domain name with the intention of deceiving unsuspecting victims. Website visitors may see a reputable name (like “Google”) in requests and assume that they’re safe to load, without noticing that the domain is not a perfect match and is actually malicious in nature,”explained Sucuri’s Luke Leal.

This tactic is often used in phishing attacks to trick victims into thinking a phishing page is actually legitimate, he added.

The card skimming script injected by the threat actor "uses the loaded JavaScript to capture any input data using the document.getElementsByTagName and input or stored element names for capturing drop down menu data." What makes it stand out from other card skimming scripts is the ability to alter its behaviour based on whether developer tools are open in Google Chrome or Mozilla Firefox. In the presence of Chrome or Firefox web browsers the skimmer script will not send collected data to command and control server likely in order to avoid detection.

“If the malicious code doesn’t detect developer tools in the browsing session, the stolen credit card information skimmed by the malware is categorized for exfiltration to a remote server. The bad actors again attempt to deceive visitors with another fake Google domain—google[.]ssl[.]lnfo[.]cc,” reads the analysis.

The researcher also notes that the credit card skimmer itself supports dozens of payment gateways suggesting that the threat actor behind the attacks put a lot of efforts in this campaign.

 

 

Back to the list

Latest Posts

New espionage campaign targets diplomatic missions and governmental institutions in Eastern Europe

New espionage campaign targets diplomatic missions and governmental institutions in Eastern Europe

The Attor malware comes with some unusual capabilities including the use of encrypted modules, Tor-based communications, and a plugin designed for GSM fingerprinting.
11 October 2019
Iran-linked Charming Kitten APT updates its arsenal with new spear-phishing techniques

Iran-linked Charming Kitten APT updates its arsenal with new spear-phishing techniques

The Iranian state-sponsored hackers Charming Kitten employed new spear-phishing methods in a campaign observed in August and September.
10 October 2019
Hackers hit Volusion e-commerce sites in pursuit of customers’ credit card data

Hackers hit Volusion e-commerce sites in pursuit of customers’ credit card data

It is estimated that more than 6,500 sites are affected, that number could be even higher.
10 October 2019
Featured vulnerabilities
Remote code execution in Bento4 media player
High Not Patched | 13 Oct, 2019
Use-after-free in libvips library
Medium Patched | 13 Oct, 2019
Denial of service in MATIO
Low Not Patched | 13 Oct, 2019
Cross-site scripting in Openfire
Low Patched | 12 Oct, 2019