A malware that is almost impossible to remove was automatically activated on Black Friday and deployed to several online stores running Magento, Dutch cybersecurity firm Sansec reports.
The hackers behind these skimming attacks (also known as Magecart) are targeting and infiltrating online stores powered by Magento 2.2.3 to 2.2.7 – starting in April 2020.
Attackers exploited several security vulnerabilities affecting these older and deprecated Magento 2.x versions to inject backdoors and insert credit card stealing scripts that allowed them to collect customers' payment card data
Credit card skimmers are JavaScript - based scripts that were introduced by Magecart criminal groups into compromised e-commerce website pages. Their goal is to exfiltrate payment information submitted by customers to servers under their control .
The hackers used a complex web skimming infrastructure that employed backend and frontend malware, as well as several protection techniques that allowed them to avoid removal from the compromised stores, even after the attack was detected .
The skimming script displayed fake custom payment forms in the compromised stores' interface and in some cases sent the collected payment information to /checkout .
This tactic was used to mimic a normal payment transaction flow to make it more difficult for e-commerce website security monitoring systems to detect any malicious activity .
Researchers report that hackers will re-infect e-commerce sites after the “hybrid skimming architecture” is removed, re-infiltrating the server and reinstalling the malware within a few days of the store being purged .
Information source: bleepingcomputer.com
