Monday, February 17, 2025
HomeInternetMagentoCore Malware That Steals Payment Card Details While You Shop Online

MagentoCore Malware That Steals Payment Card Details While You Shop Online

Published on

SIEM as a Service

Follow Us on Google News

A new payment card stealing campaign with skimmer script targeting Magento stores. The malicious campaign is embedding Javascript based MagentoCore Malware on Magento stores that record keystrokes from customers and transfer the data in real-time to magentocore command and control servers.

A Netherland security researcher Willem uncovered the attack, it appears a single group of threat actors responsible for planting skimmers on 7339 individual stores in the last 6 months.

“The average recovery time is a few weeks, but at least 1450 stores have hosted the MagentoCore[.]net parasite during the full past 6 month s.The group hasn’t finished yet: new brands are hijacked at a pace of 50 to 60 stores per day over the last two weeks.”

How the MagentoCore Malware Works

The malware gain access to the control panel of the store by using brute force techniques and once they gain access to the store they embedded a skimmer Javascript and the scripts look for inputs in fields such as credit card number, validity and billing address.

MagentoCore Malware

Once it gathers the required information it sends the data in real-time to magentocore[.]Net server that located in Moscow.

The malware also adds a backdoor to the cron file which used to configure regularly scheduled tasks. By having a backdoor added in the cron file it regularly downloads the malicious code from the server and runs the code. After running the code it also deletes itself to avoid traces.

It also removes any other competing malware found already installed in the Magento Store. Also, it uses to change the password “how1are2you3″ periodically to the admin accounts.

What Store owners Can Do

William suggested a five points to-do list for the merchants affected MagentoCore Skimmer, he also released an opensource Magento Malware Scanner. According to publicwww, the Magento script found in 5172 web pages.

Also, you can scan your Magento shop with magereport that scan’s for vulnerabilities and other infections in the store.

Also Read

Hackers Compromised More than 1,000 Magento Stores to Steal Credit Card Details and to Mine Cryptocurrency

Dangerous WordPress Keylogger Returns via New Domains that Affected More than 1000 Websites

Over 700 WordPress and Joomla Websites Infected with IonCube Malware

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Gangs Encrypt Systems 17 Hours After Initial Infection

Ransomware gangs are accelerating their operations, with the average time-to-ransom (TTR), the period between...

Stealthy Malware in WordPress Sites Enables Remote Code Execution by Hackers

Security researchers have uncovered sophisticated malware targeting WordPress websites, leveraging hidden backdoors to enable...

Xerox Printer Vulnerability Exposes Authentication Data Via LDAP and SMB

A critical security vulnerability in Xerox’s Versalink C7025 Multifunction Printer (MFP) has been uncovered,...

New XCSSET Malware Targets macOS Users Through Infected Xcode Projects

Microsoft Threat Intelligence has identified a new variant of the XCSSET macOS malware, marking...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...