Tuesday, April 22, 2025
HomeCyber AttackMagecart Group 12 Hackers Distributed New PHP based Web Skimmer to Steal...

Magecart Group 12 Hackers Distributed New PHP based Web Skimmer to Steal Credit Cards Data

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed a new wave of PHP-based Web Skimmer by Magecart group 12 threat actors to steal card details from Magento 1 websites.

Magento eCommerce platform is written by PHP, and acquired by Adobe. also frequently targeted by the threat actors specifically from the Magecart group, who have very active to attack vulnerable e-commerce platforms.

Magecart group is well known for continuously distributing new malware to attack online shopping websites by injecting a skimmer in the payment page to steal credit/debit card data.

- Advertisement - Google News

Attackers using webshell that allow an attacker to maintain remote access by exploiting the vulnerability on the eCommerce websites.

Currently observed campaign known as Smilodon or Megalodon was developed by this Magecart group to infect online stores by loading JavaScript skimming code via server-side requests dynamically.

During the research, Malwarebytes researchers observed a new piece of file mimics as favicon with the name of Magento.png, and attempt to run as ‘image/png’ but the format was looks suspicious.

PHP-based Skimmer Infection Process

Magecart group initiate this attack using a PHP-based web shell into the compromised site by replacing the legitimate shortcut icon tags with a path to the fake PNG file.

When dig into deep, researchers found the m1_2021_force directory reveals additional code very specific to credit card skimming.

researchers also found that the control servers are connected with the new domains (zolo[.]pw) happens to be hosted on the same IP address (217.12.204[.]185) as recaptcha-in[.]pw and google-statik[.]pw, domains.

What is a Dynamically loading Skimmer?

Dynamically loading skimmer is an approach used by the threat actors to inject the skimmer into the compromised website from the server-side instead of the client-side and, this approach helps attackers form being blocklisted, so consider it as more effective.

According to the researchers, In comparison, the skimmer we showed in this blog dynamically injects code into the merchant site.

“We continue to track this campaign and other activities from Magecart Group 12. Online merchants need to ensure their stores are up-to-date and hardened” Malwarebytes said.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks

In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious...

Samsung One UI Vulnerability Leaks Sensitive Data in Plain Text With No Expiration!

A glaring vulnerability has come to light within Samsung's One UI interface: the clipboard...

New Rust-Based Botnet Hijacks Routers to Inject Remote Commands

A new malware named "RustoBot" has been discovered exploiting vulnerabilities in various router models...

Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation

Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation

Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing...

Magecart Launches New Attack Using Malicious JavaScript to Steal Credit Card Data

The notorious Magecart group has been identified by the Yarix Incident Response Team as...

Japan Sounds Alarm Over Hackers Draining Millions from Compromised Trading Accounts

Cybersecurity in Japan has hit a new low as the Financial Services Agency (FSA)...