Hackers Using Formjacking Technique to Steal Credit Card Details from Payment Forms

A new Formjacking attack campaign targets leading shopping sites and steals customers payment cards and other information from checkout pages of e-commerce sites.

Attackers inject malicious Javascript with formjacking script and those scripts steal payment information entered by users on the checkout pages and send to a typo-squatted Google analytics domain.

Security researchers from Symantec identified 30 such popular websites from different countries affected with the campaign that includes fashion stores, educational websites, websites selling sports gear etc.

Also, the inject the scripts contains codes to check for the presence of debugging tools to prevent the security researchers in analyzing the scripts.

FormjackingFormjacking

The malicious scripts use to extract the URL’s loaded in the browser and determines the page visitor is in and applies a hook on the browser and collects all the information the user entered and sends to the server controlled by attackers.

“We have seen a major uptick in formjacking attacks against high-profile websites across the globe. The locally popular websites in U.S., Japan, Germany, and Australia, among other countries are injected with formjacking scripts.”

The campaign appears to be active up to at least November 25, 2018, now Symantec notifying the issues to vendors and working in resolving the same.

As a user it is not possible to identify that you are a victim of formjacking, researchers website owners monitoring of all activity on a system and block all the suspicious actions.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Top 10 Best Ways To Secure Your Computer from Cyber Attacks

Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict

A federal jury in California has ordered Israeli spyware maker NSO Group to pay approximately…

26 minutes ago

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations, particularly…

15 hours ago

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search Service…

15 hours ago

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider, has…

15 hours ago

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800 compromised…

15 hours ago

Hackers Bypass AI Filters from Microsoft, Nvidia, and Meta Using a Simple Emoji

Cybersecurity researchers have uncovered a critical flaw in the content moderation systems of AI models…

16 hours ago