Friday, July 19, 2024

Magecart Hackers Hide Stolen Credit Card Data Into Images & Selling It in DarkWeb

A brand-new technique has been used by the hackers of the Magecart threat group recently to hide stolen credit card data in the images. 

In general, the threat actors of Magecart target the e-commerce websites, as their main motive is to steal credit card details. Once they are done with the stealing process, the threat actors sell the stolen data in the underground markets in Darkweb.

However, the experts opined that the threat actors usually obfuscate the malware code inside comment sections and encode the data into images that are hosted in the server.

Hacked Magento Website

The security analyst of Sucuri, Ben Martinone pronounced that they came to know about this hack when one of their clients got attacked by the threat actors of Magecart.

The victim came to the experts with an infected Magento e-commerce website and all the details of the credit card were being stolen. After a proper analysis, the experts have eliminated a huge amount of malware, that also contains six different types of Magento credit card swipers.

During the investigation, the researchers found that the threat actors are using a 7-year-old Magento version. And it might cost from $5,000 to $50,000 to relocate a Magento 1 website to the more secure Magento 2 website. 

Examination of a Credit Card Swiper

The initial way to analyze the credit card swiper is to use a base64 encoded string for encoding the malware. However, the experts claimed that there is another way to encode this malware rather than base64, that is the gzinflate.

According to the security analysts, gzinflate is one of the popular methods, because this supplies something that uses normal letters and numbers which could be transcribed on a keyboard easily.

After a proper analysis, the experts came to know that the threat actors are using “concatenation”, and it is quite a common obfuscation method that is encountered by the researchers.

Protect your website

Protection against this type of attack is one of the important things, and every user should know that how they can shield their website from this kind of attack; so, that’s why here we have mentioned below some security measures that are recommended by the experts:-

  • Always keep your website updated and keep installing the software as soon as possible.
  • Remember to use long complex passwords.
  • Always keep your workstations secure to manage your website.
  • Apply a reliable hosting environment.
  • Lock down your management panel with extra security measures.
  • Set your website behind a firewall to block further attacks.

Here, the main motive of the threat actors is to capture customers’ payment card information, and later saved it to a bogus style sheet file (.CSS) on the server and then download the whole data. 

So, the cybersecurity analysts have affirmed that every user must follow the step that is mentioned above, apart from this, the security researchers are trying their best to circumvent such attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles