Thursday, March 28, 2024

Researcher Uncovered 1,236 Websites Infected with Credit Card Data Stealing Skimmer

The security researcher has found 1,236 vulnerable websites that were infected with the credit card data-stealing skimmer.

According to the latest reports, recently, the deadly COVID-19 pandemic has opened up the further playing field for the cyber attackers and MageCart groups. Don’t know about MageCart groups; they are generally hacking groups efficient at stealing payment card data.

The MageCart groups target two types of victims; first, the shop owners and the second is the customers of those shops, as they steal their credit card credentials and details.

Apart from all these things, to mitigate these hacking groups and their fraudulent activities, the most crucial thing that security researchers can do is to trace and uncover all the places where the skimmers are seeded, for how long they have been active, where the stolen credentials are exposed and sold.

The security researcher at Malwarebytes, Jerome Segura, said, “There was a 26% rise in skimming in March 2020, compared to February 2020.” To support this statement of Jerome Segura, RiskIQ’s Yonathan Klijnsma has also stated that “Their was a sharp 20% hike in skimming during the same time.”

Modus operandi

Usually, the attackers host their skimmers on websites through compromised third-party JavaScript libraries, and in some cases, they even buy linked JavaScript libraries as well.

After that, the attackers copy the data, which includes credit card details, and then the attackers send those details to the server controlled by them just before the payment page uploads in the web browser window.

Here the fascinating thing is that no one notices the skimming because everything happens normally, and that’s the reason no one able to notice.

Here the great sufferer is the customers, as they don’t have any idea that they become the victim of skimming, where their card details were stolen and making it difficult to find out what precisely happened.

Attribution

If anyone wants to associate any malicious campaigns or malware to a specific group, then he/she needs to have a professional level of knowledge and confidence in several factors, or else, will fail.

Apart from this, the security experts have clearly stated that there is no sufficient data is available to support this claim that ‘a specific group was behind these campaigns.’

But, still, there are a few similarities that we have mentioned below:-

  • Code similarity
  • Infection chain
  • Alleged attribution

An attacker can easily search the exact moment that the skimmer domain switched in the infection chain. Along with this, an attacker can also comb for every affected domain to find out the skimmer domains.

Shops that were affected most

Now, if we talk about the shops that were affected, then it will be quite hard to categorize them, as all the affected shops offer a wide range of services and commodities. But, still, the security researcher has classified those web-shops into five categories that we have mentioned below:-

  • Products
  • Unknown
  • Food
  • Services
  • Adult entertainment

Furthermore, here we will show you all the countries that have 15 or more affected web-shops along with the infection counts:-

  • US (303)
  • Unknown (280)
  • IN (79)
  • UK (68)
  • DE (50)
  • AU (47)
  • BR (46)
  • FR (34)
  • IT (31)
  • NL (28)
  • CA (23)
  • ES (19)
skimmer

From the above image, you can see the division of the branches of all 1,236 infected web-shops. Apart from this, the security researchers have also stated that only 70% of web-shops were reachable from the 1,236 infected web-shops or websites.

Since the skimmers are generic and easily obtainable, it will be quite hard to associate these campaigns to a specific group.

Recently, if you have done your shopping at any web-shops, then it may be possible that your payment card credentials were compromised.

In this case, the security experts strongly recommended that the victims should immediately contact their respective banks to take proper security measures to safeguard their data.

So, what do you think about this? Simply share all your views and thoughts in the comment section below.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles