A new online POS skimmer used by one of the Magecart groups has
been spotted injecting an iframe into retailer websites that asks for payment
card information.Malwarebytes came across the new technique being used on a
Magento powered e-commerce platform. Unlike other skimming methods, which search
for the active payment form on the page and replace it with one prepped for
skimming, the new version simply inserts an iframe onto a shopping cart check
out page that asks for the visitor’s name, credit card number, CVV and
expiration date, said
Malwarebytes Head of Threat Intelligence Jerome Segura.The malware is injected into all the PHP pages on the
targeted site, but the ifram is only activated when the shopper visits the
shopping cart check out page.“If the right conditions are met, an external piece of
JavaScript is loaded from thatispersonal[.]com, a domain registered with
REGISTRAR OF DOMAIN NAMES REG.RU LLC and hosted in Russia,” Segura said.
The dead giveaway that something is amiss is the shopper is being asked for this info, and then told they will be shifted to a third-party site where the transaction will be completed.“By itself, this may not be out of the ordinary since online
merchants do use such forms (including iframes) as part of their checkout
pages,” Segura said, adding, “Why would a merchant want to get their customers
to type in their credit card again and hurt their conversion rate?”The malware does validate the credit card data before it is
exfiltrated and then the customer is actually taken to the legitimate payment
page after their information is stolen.
The Hacker News disclosed that the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.
The UK's National Cyber Security Centre (NCSC) issued an alert regarding a new 'zero-click' threat campaign orchestrated by Russian state-backed hackers targeting organizations across critical sectors, according to a recent report by IT Pro.
An open-source AI assistant named Hermes was used in a cyberattack targeting Thailand's Ministry of Finance, compromising sensitive personnel data and internal systems.
