Thursday, March 28, 2024

Magecart Group 12 Hackers Distributed New PHP based Web Skimmer to Steal Credit Cards Data

Researchers observed a new wave of PHP-based Web Skimmer by Magecart group 12 threat actors to steal card details from Magento 1 websites.

Magento eCommerce platform is written by PHP, and acquired by Adobe. also frequently targeted by the threat actors specifically from the Magecart group, who have very active to attack vulnerable e-commerce platforms.

Magecart group is well known for continuously distributing new malware to attack online shopping websites by injecting a skimmer in the payment page to steal credit/debit card data.

Attackers using webshell that allow an attacker to maintain remote access by exploiting the vulnerability on the eCommerce websites.

Currently observed campaign known as Smilodon or Megalodon was developed by this Magecart group to infect online stores by loading JavaScript skimming code via server-side requests dynamically.

During the research, Malwarebytes researchers observed a new piece of file mimics as favicon with the name of Magento.png, and attempt to run as ‘image/png’ but the format was looks suspicious.

PHP-based Skimmer Infection Process

Magecart group initiate this attack using a PHP-based web shell into the compromised site by replacing the legitimate shortcut icon tags with a path to the fake PNG file.

When dig into deep, researchers found the m1_2021_force directory reveals additional code very specific to credit card skimming.

researchers also found that the control servers are connected with the new domains (zolo[.]pw) happens to be hosted on the same IP address (217.12.204[.]185) as recaptcha-in[.]pw and google-statik[.]pw, domains.

What is a Dynamically loading Skimmer?

Dynamically loading skimmer is an approach used by the threat actors to inject the skimmer into the compromised website from the server-side instead of the client-side and, this approach helps attackers form being blocklisted, so consider it as more effective.

According to the researchers, In comparison, the skimmer we showed in this blog dynamically injects code into the merchant site.

“We continue to track this campaign and other activities from Magecart Group 12. Online merchants need to ensure their stores are up-to-date and hardened” Malwarebytes said.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles