Saturday, December 2, 2023

Magecart Threat Actors Using Highly Evasive Skimmer to Steal Credit Card Data

Cybersecurity researchers at Cyble Research & Intelligence Labs have identified a tweet with a JavaScript skimmer that is mentioned by a security analyst on Twitter. 

The Magecart threat group has created this skimmer that mainly steals data related to payments from the Magento website, which is an e-commerce platform.

By exploiting the security flaws in the popular CMS, the operators of Magecart attack the Magento e-commerce websites. By doing so the attackers are able to inject malicious JavaScript into the source code of the website as a result of this exploit.

Data Involve

There is malicious code embedded in the checkout page and payment form of the compromised website which attempts to collect the following payment information:- 

  • Credit card number
  • Debit card number
  • Credit card owner’s name
  • Debit card  owner’s name
  • Credit CVV number
  • Debit CVV number
  • Credit card expiry date
  • Debit card expiry date

There is also a check written into the malicious code which determines that the data is in the right format and displays that information.

Magento Card-Skimming

An open-source e-commerce platform, Magento is completely based on PHP, and it’s a platform that facilitates the creation of e-commerce websites for programmers.

The Magento card skimming technique exploits vulnerabilities in Magento’s e-commerce software to steal credit cards from customers. While they do so, they are able to access the source code of the website.

According to the report, Once the threat actors have obtained access to the compromised website, they inject malicious JavaScript into it. By doing this, the threat actors track all the payment forms and checkout processes to steal customers’ financial data.

As soon as the JavaScript is executed, it checks for the presence of anti-skimmer features, which prevent the skimmer from detecting it. In this way, it is prevented from loading when the browser is using its dev tool at the same time.

A JavaScript file retrieves the payment information from the victim once they have entered it into the form. Thereafter, the POST method is used in order to send the Base64-encoded data through this method to the URL included in the script.


Following are some of the best cybersecurity practices that we believe to be essential:-

  • Consider using an anti-virus and internet security software package that has a reputable name in the industry.
  • The use of warez and torrent websites for downloading pirated software must be avoided.
  • Where possible, you should enforce multi-factor authentication in all areas of your business and use strong passwords.
  • Make sure you verify the authenticity of any links and email attachments before you open them. 
  • Make sure that employees are aware of what threats may exist, such as phishing websites and URLs that are untrusted.
  • Updating your operating system, applications, and devices is essential.
  • Ensure that URLs that are likely to be used for spreading malware, such as torrents and warez sites, are blocked.
  • In order to protect the data from being stolen by malware, you need to monitor the beacon at the network level.
  • On the employee’s systems, make sure that a Data Loss Prevention (DLP) Solution is enabled.

Download Free SWG – Secure Web Filtering – E-book


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles