Thursday, December 5, 2024
HomeCyber AttackResearcher Uncovered 1,236 Websites Infected with Credit Card Data Stealing Skimmer

Researcher Uncovered 1,236 Websites Infected with Credit Card Data Stealing Skimmer

Published on

SIEM as a Service

The security researcher has found 1,236 vulnerable websites that were infected with the credit card data-stealing skimmer.

According to the latest reports, recently, the deadly COVID-19 pandemic has opened up the further playing field for the cyber attackers and MageCart groups. Don’t know about MageCart groups; they are generally hacking groups efficient at stealing payment card data.

The MageCart groups target two types of victims; first, the shop owners and the second is the customers of those shops, as they steal their credit card credentials and details.

- Advertisement - SIEM as a Service

Apart from all these things, to mitigate these hacking groups and their fraudulent activities, the most crucial thing that security researchers can do is to trace and uncover all the places where the skimmers are seeded, for how long they have been active, where the stolen credentials are exposed and sold.

The security researcher at Malwarebytes, Jerome Segura, said, “There was a 26% rise in skimming in March 2020, compared to February 2020.” To support this statement of Jerome Segura, RiskIQ’s Yonathan Klijnsma has also stated that “Their was a sharp 20% hike in skimming during the same time.”

Modus operandi

Usually, the attackers host their skimmers on websites through compromised third-party JavaScript libraries, and in some cases, they even buy linked JavaScript libraries as well.

After that, the attackers copy the data, which includes credit card details, and then the attackers send those details to the server controlled by them just before the payment page uploads in the web browser window.

Here the fascinating thing is that no one notices the skimming because everything happens normally, and that’s the reason no one able to notice.

Here the great sufferer is the customers, as they don’t have any idea that they become the victim of skimming, where their card details were stolen and making it difficult to find out what precisely happened.

Attribution

If anyone wants to associate any malicious campaigns or malware to a specific group, then he/she needs to have a professional level of knowledge and confidence in several factors, or else, will fail.

Apart from this, the security experts have clearly stated that there is no sufficient data is available to support this claim that ‘a specific group was behind these campaigns.’

But, still, there are a few similarities that we have mentioned below:-

  • Code similarity
  • Infection chain
  • Alleged attribution

An attacker can easily search the exact moment that the skimmer domain switched in the infection chain. Along with this, an attacker can also comb for every affected domain to find out the skimmer domains.

Shops that were affected most

Now, if we talk about the shops that were affected, then it will be quite hard to categorize them, as all the affected shops offer a wide range of services and commodities. But, still, the security researcher has classified those web-shops into five categories that we have mentioned below:-

  • Products
  • Unknown
  • Food
  • Services
  • Adult entertainment

Furthermore, here we will show you all the countries that have 15 or more affected web-shops along with the infection counts:-

  • US (303)
  • Unknown (280)
  • IN (79)
  • UK (68)
  • DE (50)
  • AU (47)
  • BR (46)
  • FR (34)
  • IT (31)
  • NL (28)
  • CA (23)
  • ES (19)
skimmer

From the above image, you can see the division of the branches of all 1,236 infected web-shops. Apart from this, the security researchers have also stated that only 70% of web-shops were reachable from the 1,236 infected web-shops or websites.

Since the skimmers are generic and easily obtainable, it will be quite hard to associate these campaigns to a specific group.

Recently, if you have done your shopping at any web-shops, then it may be possible that your payment card credentials were compromised.

In this case, the security experts strongly recommended that the victims should immediately contact their respective banks to take proper security measures to safeguard their data.

So, what do you think about this? Simply share all your views and thoughts in the comment section below.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024

One Identity named Hot Company: Privileged Access Management (PAM) in 12th Cyber Defense Magazine’s...

HCL DevOps Deploy / Launch Vulnerability Let Embed arbitrary HTML tags

Recently identified by security researchers, a new vulnerability in HCL DevOps Deploy and HCL...

CISA Warns of Zyxel Firewalls, CyberPanel, North Grid, & ProjectSend Flaws Exploited in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about several vulnerabilities being...

HackSynth : Autonomous Pentesting Framework For Simulating Cyberattacks

HackSynth is an autonomous penetration testing agent that leverages Large Language Models (LLMs) to...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Deloitte Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte...

UK Healthcare Provider Hit by Cyberattack, Services Affected

Wirral University Teaching Hospital in the UK has been hit by a targeted cyberattack,...

SMOKEDHAM Backdoor Mimic As Legitimate Tools Leveraging Google Drive & Dropbox

UNC2465, a financially motivated threat actor, leverages the SMOKEDHAM backdoor to gain initial access...