Cybersecurity researchers from Malwarebytes have discovered a new credit card information stealing campaign that uses complex, legitimate-looking payment forms that are very hard to spot for the average user.
The researchers spotted multiple online ecommerce (opens in new tab) stores being breached, and a modal being placed on top of their actual payment forms.
The modals are HTML content overlaid over the top of the main webpage, which allows the user to interact with the login forms and notifications without leaving the site.
Hiding in plain sight
The modals look so good, (in some cases even being “better than the original”) that it’s almost impossible for the average user to discover anything amiss. In one of the campaigns, the researchers said, the modal displayed the site’s brand logo, correct language, and “elegant interface elements”.
Victims who try to buy something from these compromised websites would get a bogus error message which would redirect them to the actual payment URL to try and repeat the payment. That way hackers made sure their modals remained inconspicuous for as long as possible. The hackers would also plant a cookie on the endpoint of the victim, in order to prevent duplicate entries.
When it comes to discovering who the threat actors behind the campaign are, the jury is still out. Malwarebytes’ researchers speculate that it might be MageCart. However, they also said one of the victims was compromised by the Kritec campaign, which is a JavaScript skimmer Malwarebytes first found on Magento stores more thana year ago.
“It is possible multiple threat actors are involved in those campaigns and customizing skimmers accordingly,” reads the report (opens in new tab). “While many hacked stores had a generic skimmer, it appears the custom modals were developed fairly recently, maybe a month or two ago.”
It seems we might have to go back to one-time private cards with charge limits, to prevent our hard-earned money from getting into the wrong hands.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba