Magecart: The FBI has recently issued a warning for the US private sector about the increase in Magecart attacks seen within the past two years. Attacks originally started in 2016, all categorized under the Magecart umbrella name, which incorporates attacks dealing with skimming credit cards through a website (E-skimming). E-skimming can happen in three steps and is a very lucrative attack style for the threat actor. The threat actor has to first gain access to the webserver hosting a company’s online store. After access is obtained, the attacker will hide malicious JavaScript code on the website, primary placing it on the checkout page, to gather the payment information from customer orders. Originally, the attacks were carried out through open-source e-shopping platforms with the attacker finding vulnerabilities within the platform to plant the skimmer. More recently, however, threat actors have been evolving their techniques, now being able to compromise almost any online shopping website even if they are not using open source platforms. Along with the standard method that targets one store at a time, they also target third-party companies that provide widgets to online stores (i.e. EU cookie compliance and tech support widgets). Threat actors will also target the cloud hosting account of websites that have been left open with “write” privileges, allowing the attackers to modify the source code for the website. Some groups are opting to send phishing emails to the stores trying to compromise an administrator account which would allow them to place the skimmer on the website, as well as groups targeting websites that produce checkout platforms used by many stores allowing them to infect thousands of stores at once with their skimmer.
12 Essentials for a Successful SOC Partnership
Binary Defense
January 12, 2023
As cyber threats continue to impact businesses of all sizes, the need for round-the-clock security
