Digital Predators: Long-Running Web Skimming Campaign Siphons Card Data from E-commerce Checkouts
In an alarming revelation for online shoppers and businesses alike, cybersecurity researchers have unearthed a sophisticated web skimming campaign that has been silently siphoning credit card information and personal data from major e-commerce platforms since January 2022. This persistent threat, a modern iteration of the notorious Magecart attacks, targets unsuspecting users at the most vulnerable point of their online journey: the checkout page.
The Persistent Shadow of Magecart Attacks
Digital skimming, often categorized under the umbrella term ‘Magecart,’ refers to client-side attacks where malicious actors compromise legitimate e-commerce sites. Their goal is to inject stealthy JavaScript code designed to harvest sensitive user data, including credit card details, as payments are processed. Initially associated with groups targeting Magento-powered sites, Magecart’s reach has since expanded across various platforms and payment networks.
Unmasking the Campaign’s Reach
The current campaign demonstrates a wide net, specifically targeting major payment networks such as American Express, Diners Club, Discover, JCB Co., Ltd., Mastercard, and UnionPay. According to a report by Silent Push, “Enterprise organizations that are clients of these payment providers are the most likely to be impacted,” underscoring the significant risk to large-scale online operations.
Unveiling the Skimmer’s Modus Operandi
The discovery of this extensive operation began with the analysis of a suspicious domain linked to Stark Industries (and its parent company PQ.Hosting), a bulletproof hosting provider that has since been sanctioned and rebranded to THE[.]Hosting under WorkTitans B.V. in an apparent sanctions evasion maneuver. The domain in question, cdn-cookie[.]com, was found to be hosting highly obfuscated JavaScript payloads, such as “recorder.js” or “tab-gtm.js,” which are discreetly loaded by compromised web shops to facilitate the credit card skimming.
Sophisticated Evasion and Deception Tactics
What sets this campaign apart is the advanced sophistication of its evasion and deception techniques, designed to bypass detection by site administrators and trick users.
Administrator Evasion and Self-Destruct Mechanisms
The skimmer is programmed with a clever self-preservation mechanism. It actively scans the Document Object Model (DOM) tree for an element named “wpadminbar.” This element is a tell-tale sign of a logged-in administrator or a user with elevated permissions on a WordPress website. If “wpadminbar” is detected, the skimmer immediately initiates a self-destruct sequence, erasing its presence from the web page to avoid detection. Furthermore, the skimmer attempts to execute every time the web page’s DOM is modified, a common occurrence during user interaction, ensuring persistent threat activation.
Targeting Stripe and Crafting Fake Forms
The attackers also exhibit a deep understanding of payment gateway integrations, particularly Stripe. The skimmer checks if Stripe is the selected payment option. If so, it looks for a “wc_cart_hash” element in the browser’s localStorage. The absence of this flag triggers the skimmer to render a convincing, yet fake, Stripe payment form, replacing the legitimate one through user interface manipulations. Victims are then tricked into entering their credit card numbers, expiration dates, and Card Verification Code (CVC) numbers into this fraudulent form.
According to Silent Push, “As the victim entered their credit card details into a fake form instead of the real Stripe payment form, which was initially hidden by the skimmer when they initially filled it out, the payment page will display an error.” This cunning tactic makes it appear as though the user simply made an input error, masking the true nature of the data theft.
The Stolen Bounty: Beyond Card Numbers
The scope of data stolen by this advanced skimmer extends far beyond just payment details. It also includes sensitive personal information such as names, phone numbers, email addresses, and shipping addresses. This comprehensive haul is then exfiltrated via an HTTP POST request to the server lasorie[.]com.
Once the data transmission is complete, the skimmer meticulously erases its tracks from the checkout page. It removes the fake payment form and restores the legitimate Stripe input form, leaving no immediate visual evidence of the compromise. To prevent re-skimming the same victim, it sets the “wc_cart_hash” flag to “true.”
A Glimpse into the Attacker’s Expertise
The sophistication of this campaign speaks volumes about the perpetrators’ capabilities. Silent Push notes, “This attacker has advanced knowledge of WordPress’s inner workings and integrates even lesser-known features into their attack chain.” This deep technical understanding allows them to craft highly effective and resilient skimming operations that are difficult to detect and mitigate.
For businesses and consumers alike, this ongoing campaign serves as a stark reminder of the evolving landscape of cyber threats. Vigilance, robust security practices, and continuous monitoring are paramount to safeguarding sensitive financial and personal data in the digital realm.
For more details, visit our website.
Source: Link
