Magecart Hackers Compromise 80 More eCommerce Sites to Steal Credit Cards

Cybersecurity researchers have discovered over 80 Magecart
compromised e-commerce websites that were actively sending credit
card information of online shoppers to the attackers-controlled
servers.

Operating their businesses in the United States, Canada, Europe,
Latin America, and Asia, many of these compromised websites are
reputable brands in the motorsports industry and high fashion,
researchers at Aite Group and Arxan Technologies revealed today in
a report shared with The Hacker News.

In a world that’s growing increasingly digital, Magecart
attacks^[1] have emerged as a key
cybersecurity threat to e-commerce websites.

Magecart is an
umbrella term given to different cybercriminal groups that are
specialized in secretly implanting online credit card
skimmers on compromised e-commerce websites with an intent to
steal payment card details of their customers.
^[2][3]

These virtual credit card skimmers, also known as formjacking
attack, are basically JavaScript code that hackers secretly
insert into a compromised website, often on the shopping cart page,
designed to capture payment information of customers in real-time
and send it to a remote attacker-controlled server.

Magecart is in the news a lot lately for conducting several
high-profile heists against major companies including British
Airways, Ticketmaster,
Newegg, and
others.
^[5][6][7][8]

The newly disclosed
campaign doesn’t belong to a single group of Magecart hackers;
instead, researchers used a source code search engine to search for
obfuscated JavaScript on the Internet with malicious patterns that
were previously seen in the Magecart’s virtual credit card
skimmers.

According to the researchers, the technique allowed them to
quickly uncover more than 80 e-commerce websites compromised by
Magecart groups, most of which were found running over outdated
versions of Magento CMS that’s vulnerable to an unauthenticated
upload and remote code execution vulnerabilities.

Though the researchers have not named the compromised companies in
its report, they worked with federal law enforcement to notify all
affected organizations as well as off-site servers prior to
publishing their report.
“Because this is an ongoing and active project, we have decided not
to name the victim sites,” the researchers told The Hacker News.

In addition, the researchers also analyzed Magecart’s
monetization activities and found that besides selling the stolen
payment card data on the dark web forums, the attackers also
purchase merchandise on legitimate online shopping sites and ship
them to pre-selected merchandise mules in an attempt to launder the
fraudulent transactions.

The mules then work with local shippers who receive under-the-table
pay to send merchandise to the eastern European destinations, where
it is sold to local buyers, eventually profiting attackers as a
second line of revenue.
The researchers recommend e-commerce websites to, at foremost
priority, update or patch their platform software to the latest
version that protects them from known exploits.

Besides this, e-commerce websites should also implement code
obfuscation and white-box cryptography to make the web forms
unreadable to the adversary, as well as solutions to detect
unauthorized modification of website files.

Online shoppers are also advised to regularly review their
payment card details and bank statements for any unfamiliar
activity. No matter how small unauthorized transaction you notice,
you should always report it to your financial institutions
immediately.

^[4][9]