@BushidoToken Threat Intel

  On 13 March, SanSec disclosed a new Magecart domain used to host malicious JavaScript (.js) files that can collect credit card information from ecommerce site checkout pages. The site (jquerycdn[.]at) that hosted the scripts was present on at least 299 different victim stores. The most commonly attacked platform is Magento 1 ecommerce platform. Notably, support for Magento 1 ended on 30 June 2020, meaning that it will no longer receive security updates. How does the web skimmer work? “Web skimmers are loaded on the checkout page of a typical store. It lives in the browser of an unsuspecting online customer. Whenever he or she enters her payment information, the private data is siphoned off to an offshore server. Usually, this data is then sold on the dark web within 2-10 weeks.” - SanSec.  In this blog, I analysed the JavaScript Skimmers connected to jquerycdn[.]at in an ongoing campaign :  knockout-fast-foreach.js 46fa357596e58272e6e2865c8b80bb96eb910c577267ce64bcada7...

The Magecart collective is a myriad of distinct cybercriminal groups which are strategically inserting credit card skimming code on to compromised e-commerce websites, at an unprecedented rate and with frightening success. Magecart achieved infamy after two data heists from Ticketmaster and British Airways. Hundreds of thousands of customers’ card payment information had been lifted via a few lines of JavaScript code injected onto the pages where customers fill out their credit card numbers. (Figure 1) Figure 1 Magecart attacks are designed to evade detection systems like a web application firewall  (WAF), antivirus solutions, and traditional firewalls, by executing their inserted code in the browser. This attack works by compromising third-party services, like Amazon Web Services (AWS), shopping cart software, and WordPress plugins among others to insert their code on to the page where customers fill out their credit card information.  This inserted co...