A recently discovered multi-platform credit card skimmer can harvest payment info on compromised stores powered by Shopify, BigCommerce, Zencart, and Woocommerce.
While usually designed to target a single type of e-commerce platform, this new type of web skimming malware can take over the checkout process on shops using multiple online store management systems by injecting a malicious checkout page.
Displays errors as distraction
This new skimmer (also known as a Magecart script) can also abuse hosted e-commerce systems such as Shopify and BigCommerce, as researchers at Dutch cyber-security company Sansec found, even though they do not provide support for custom checkout pages scripts.
It does that by displaying a fake payment page before the customers land on the real checkout form and using a keylogger to intercept payment and personal information.
The skimmer will also throw an error after the customers hit the “Proceed” button to submit their credit card information to evade detection and not raise any alarm flags., redirecting them back to the legitimate checkout process and payment form.
“It is remarkable that so many different platforms are compromised in the same campaign,” Sansec said.
“Typically, criminals exploit a flaw in a single platform. Attackers may have breached a shared component, eg software or a service that is used by all affected merchants.”
Campaign active since August 2020
Another interesting technique used by this skimmer is the way it exfiltrates data to automatically generated domains based on a counter and encoded using base64 encoding (examples of such domains are zg9tywlubmftzw5ldza[.]com, zg9tywlubmftzw5ldze[.]com, and so on).
This also offers a hint on how long this Magecart campaign has been running for, given that the first such programmatically generated exfiltration domain was first registered on August 31st, 2020.
“To summarize: this campaign shows that platforms are no boundary to the profitable fraud of online skimming,” Sansec added. “Wherever customers enter their payment details, they are at risk.”
During the last few months, Sansec researchers have discovered several Magecart campaigns using innovative tactics for evading detection and gaining persistence on hacked stores.
For instance, they found a credit card stealer script hidden in plain sight using CSS code to avoid getting discovered, a web skimming malware able to camouflage as SVG social media buttons, and an almost impossible to get rid of credit card stealer bundling a persistent backdoor.
They also spotted a stealthy remote access trojan (RAT) malware used by Magecart threat actors to maintain persistence and regain access to the servers of hacked online stores.
However, the malware dropper used to load the RAT on infected online shops also inadvertently spilled the beans on a list of dozens of compromised stores.
To read the original article: