Malwarebytes cybersecurity researchers have uncovered a new credit card stealing campaign that uses complex and legitimate-looking payment forms that are difficult for the average user to find.
Researchers have found multiple online e-commerce (opens in new tab) A store is compromised and a modal is placed on top of the actual payment form.
A modal is HTML content that overlays the main web page and allows users to interact with login forms and notifications without leaving the site.
hidden in plain sight Modals look so good (sometimes even “better than the original”) that it’s almost impossible for the average user to spot any issues. In one of his campaigns, the modal displayed the site’s branding his logo, correct language, and “elegant interface elements,” according to the researchers.
Victims trying to purchase anything from these compromised websites receive fake error messages that redirect them to the actual payment URL and attempt to repeat the payment. This way the hackers made the modal as unobtrusive as possible. The hacker plants her cookie on the victim’s endpoint to prevent duplicate entries.
The jury is still out when it comes to discovering who the threat actor behind the campaign is, with Malwarebytes researchers speculating it could be MageCart. However, it also states that one of her victims was compromised by her Kritec campaign. This is the JavaScript skimmer Malwarebytes that he first spotted on the Magento store over a year ago.
“Multiple threat actors may have been involved in these campaigns and customized their skimmers accordingly,” reads the report. (opens in new tab) “Many of the stores that were hacked had generic skimmers, but custom modals appear to have been developed very recently, perhaps a month or two ago.”
It looks like we’ll have to go back to one-off private cards with charge limits to keep our hard-earned money out of the wrong hands.
Via: BleepingComputer (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings