The security researcher has found 1,236 vulnerable websites that were infected with the credit card data-stealing skimmer.

According to the latest reports, recently, the deadly COVID-19 pandemic has opened up the further playing field for the cyber attackers and MageCart groups. Don’t know about MageCart groups; they are generally hacking groups efficient at stealing payment card data.

The MageCart groups target two types of victims; first, the shop owners and the second is the customers of those shops, as they steal their credit card credentials and details.

Apart from all these things, to mitigate these hacking groups and their fraudulent activities, the most crucial thing that security researchers can do is to trace and uncover all the places where the skimmers are seeded, for how long they have been active, where the stolen credentials are exposed and sold.

The security researcher at Malwarebytes, Jerome Segura, said, “There was a 26% rise in skimming in March 2020, compared to February 2020.” To support this statement of Jerome Segura, RiskIQ’s Yonathan Klijnsma has also stated that “Their was a sharp 20% hike in skimming during the same time.”

Modus operandi

Usually, the attackers host their skimmers on websites through compromised third-party JavaScript libraries, and in some cases, they even buy linked JavaScript libraries as well.

After that, the attackers copy the data, which includes credit card details, and then the attackers send those details to the server controlled by them just before the payment page uploads in the web browser window.

Here the fascinating thing is that no one notices the skimming because everything happens normally, and that’s the reason no one able to notice.

Here the great sufferer is the customers, as they don’t have any idea that they become the victim of skimming, where their card details were stolen and making it difficult to find out what precisely happened.

Attribution

If anyone wants to associate any malicious campaigns or malware to a specific group, then he/she needs to have a professional level of knowledge and confidence in several factors, or else, will fail.

Apart from this, the security experts have clearly stated that there is no sufficient data is available to support this claim that ‘a specific group was behind these campaigns.’

But, still, there are a few similarities that we have mentioned below:-

• Code similarity
• Infection chain
• Alleged attribution

An attacker can easily search the exact moment that the skimmer domain switched in the infection chain. Along with this, an attacker can also comb for every affected domain to find out the skimmer domains.

Shops that were affected most

Now, if we talk about the shops that were affected, then it will be quite hard to categorize them, as all the affected shops offer a wide range of services and commodities. But, still, the security researcher has classified those web-shops into five categories that we have mentioned below:-

• Products
• Unknown
• Food
• Services
• Adult entertainment

Furthermore, here we will show you all the countries that have 15 or more affected web-shops along with the infection counts:-

• US (303)
• Unknown (280)
• IN (79)
• UK (68)
• DE (50)
• AU (47)
• BR (46)
• FR (34)
• IT (31)
• NL (28)
• CA (23)
• ES (19)

From the above image, you can see the division of the branches of all 1,236 infected web-shops. Apart from this, the security researchers have also stated that only 70% of web-shops were reachable from the 1,236 infected web-shops or websites.

Since the skimmers are generic and easily obtainable, it will be quite hard to associate these campaigns to a specific group.

Recently, if you have done your shopping at any web-shops, then it may be possible that your payment card credentials were compromised.

In this case, the security experts strongly recommended that the victims should immediately contact their respective banks to take proper security measures to safeguard their data.

So, what do you think about this? Simply share all your views and thoughts in the comment section below.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.