Tuesday, December 3, 2024
Homecyber securityHackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Published on

SIEM as a Service

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting WooCommerce online stores to steal credit card information.

This alarming trend highlights the persistent threat cybercriminals pose and the need for robust security measures in the digital landscape.

Obscure Dessky Snippets Plugin Used for Malicious PHP Injections

The attack was first identified when reports of stolen credit card information surfaced, prompting an investigation by cybersecurity analyst Conrado Torquato.

- Advertisement - SIEM as a Service

According to Sucuri reports, the attackers leveraged the Dessky Snippets plugin, a relatively unknown WordPress plugin with only a few hundred active installations.

This plugin allowed the attackers to add malicious PHP code to the victim websites, effectively compromising the checkout process on WooCommerce stores.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

The malicious code was cleverly hidden beneath several blank lines in the plugin’s code, making it difficult for website owners to detect.

The attack occurred on May 11th, and we see a relatively large spike in downloads of this plugin
The attack occurred on May 11th, and we see a relatively large spike in downloads of this plugin

This code was designed to modify the billing form during checkout, adding new fields to capture credit card details and send them to a third-party URL.

Malware Analysis Reveals Sophisticated Evasion Techniques

The malware embedded in the Dessky Snippets plugin was highly obfuscated, employing two main chunks of code.

The attack occurred on May 11th, and we see a relatively large spike in downloads of this plugin

The first chunk used a bogus function named twentytwenty_get_post_logos, which acted as a hook to the WooCommerce woocommerce_after_checkout_billing_form hook.

This function added new fields to the billing form, tricking users into entering their credit card details.

The second chunk of code monitored POST data for specific parameters related to the injected form fields. Once detected, the malware sent the captured credit card information to a third-party URL.

To evade detection, the fake checkout overlay fields were set with autocomplete=”off.” This prevented browsers from warning users about entering sensitive information and made the fields appear as legitimate inputs.

E-commerce websites are prime targets for hackers due to the valuable data they handle.

To protect your online store from such attacks, consider the following security measures:

  1. Keep Your Software Patched: Regularly update your CMS, plugins, themes, and third-party components to patch vulnerabilities.
  2. Use Strong Passwords: Ensure all accounts, including admin, sFTP, and database credentials, have strong and unique passwords.
  3. Select Trusted Scripts: Only integrate third-party JavaScript from reputable sources and avoid unnecessary third-party scripts.
  4. Monitor for Threats: Regularly check your site for signs of malware, unauthorized changes, or any indicators of compromise.
  5. Implement a Firewall: Use a web application firewall to block malicious bots, virtually patch known vulnerabilities, and filter harmful traffic.
  6. Set Up a CSP: Establish a Content Security Policy (CSP) to protect against clickjacking, cross-site scripting (XSS), and other threats.

For website visitors, using script-blocking extensions like NoScript and maintaining robust antivirus software can help detect and prevent ongoing skimming attacks.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform

Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation...

Salesforce Applications Vulnerability Could Allow Full Account Takeover

A critical vulnerability has been discovered in Salesforce applications that could potentially allow a...

TP-Link HomeShield Function Vulnerability Let Attackers Inject Malicious Commands

A significant vulnerability has been identified in TP-Link's HomeShield function, affecting a range of...

ElizaRAT Exploits Google, Telegram, & Slack Services For C2 Communications

APT36, a Pakistani cyber-espionage group, has recently upgraded its arsenal with ElizaRAT, a sophisticated...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform

Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation...

Salesforce Applications Vulnerability Could Allow Full Account Takeover

A critical vulnerability has been discovered in Salesforce applications that could potentially allow a...

TP-Link HomeShield Function Vulnerability Let Attackers Inject Malicious Commands

A significant vulnerability has been identified in TP-Link's HomeShield function, affecting a range of...