Beware of Payment Forms - A Modern Look Can Be Deceiving

An ongoing Magecart campaign has caught the attention of cybersecurity researchers for its use of fake payment forms to defraud unsuspecting users and steal their sensitive data.

“The threat actor used original logos from the compromised online store and customized a web element known as a modal to perfectly hijack the checkout page”, said Jérôme Segura, director of threat intelligence at Malwarebytes. “What is remarkable here is that the skimmer looks more authentic than the original payment page.”

The term Magecart is an umbrella term for many forms of cybercrime that use web skimming techniques to steal personal data from websites, most commonly customer details and payment information on e-commerce websites.

The name comes from the hackers' original targeting of Magento with these techniques. According to data shared by Sansec, the first Magecart-style attacks were observed as early as 2010. As of 2022, more than 70,000 online stores are estimated to have been compromised and to have carried a web skimming method, in other words a form of online financial fraud.

These web skimming attacks, also called formjacking because they take place inside payment forms, have traditionally relied on various JavaScript exploitation methods to steal sensitive information from website users.

Comment by Olet

This is an extremely dangerous fraud method that can confuse even the experts.

The latest fraud attempt was observed by Malwarebytes on an unnamed Parisian travel accessories store running on the PrestaShop CMS. It involved injecting a skimmer called Kritec in order to intercept the checkout and show victims a fake payment details window.

Kritec, which both Akamai and Malwarebytes have recently looked into, appears to impersonate third-party services such as Google Tag Manager in order to avoid detection.

The cybersecurity company said the skimmer is both complex and heavily obfuscated. The malicious modal appears to load when credit card is chosen as the payment method on the compromised website.

Once the payment card details have been collected, the victim briefly sees a fake error message about the payment being canceled before being redirected to the real payment page, where the payment then goes through.

Comment by Olet

By this point, however, the damage has already been done and the hacker already has the card details.

“The skimmer will drop a cookie that will serve as an indicator that the current session is now marked as completed”, Segura explained. “If the user were to go back and attempt the payment again, the malicious modal would no longer be displayed.”

The hackers behind the campaign appear to use different domains to host the skimmer, all given similar names: “[name of store]-loader.js”, which suggests that the attacks target different online stores with customized modals.

Comment by Olet

So we can see that specific websites are being targeted, presumably ones with high traffic. We also note that the IP addresses shown below have Russian domains as their hostname, while also being linked to low-cost, low-quality TLDs.

“Telling whether an online store is trustworthy has become very difficult, and this case is a good example of a skimmer that would not raise any suspicion”, Segura said.

The findings come a little more than two months after Malwarebytes discovered another web skimmer that collects browser data, such as IP addresses and User-Agent strings, along with credit card information, probably in an attempt to track invalid users such as bots and security researchers.

Source of the above: https://thehackernews.com/2023/04/attention-online-shoppers-dont-be.html

Is there a way to deal with or avoid Magecart?

That is a very good and difficult question. To answer it, we need to look at the facts we have.

The facts about Magecart

As you can see, Magecart attacks are scripts that create fake modals to replace the real modals that ask you to enter your card details. They are complex and sophisticated, and they are being dealt with by giant companies such as Akamai and Malwarebytes.

Magecart is also nothing new. It has been around since 2010 and is estimated to have infected tens of thousands of websites.

In addition, as mentioned, each Magecart script creates a customized modal rather than an identical one, so that it is harder to detect.

And in its article, Akamai mentions that it offers a service called “Page Integrity Manager” that can detect similar threats. The service page, however, gives no price, so we cannot see an indicative cost. We do know, though, that Akamai only works with very large businesses and organizations.

What we conclude about Magecart

The fact that Magecart is keeping giant cybersecurity companies busy tells us that it is something big and hard to deal with.

From what we can make out from the information these companies provide, Magecart is extremely hard to detect for anyone who is not a cybersecurity specialist. This means that the hackers who use it know their craft well and know how to fool the security systems that, small or large, are always there.

At the same time, these attacks are very sophisticated and have been developed over many years. So we can be sure that such fraud attempts are not the work of lone hackers but of groups of several people. Judging from cases where hackers have been arrested, we are usually talking about groups of 3 to 5 people.

We also see that the hackers create customized modals. So the attacks are targeted rather than generic. These days, generic attacks are usually left to bots. Since the hacker makes targeted attacks, we would expect them to target websites with high traffic and high turnover in order to make more money.

Obviously no hacker will bother with low-value or unimportant targets when they can go after big ones. In other words, this attack method does not threaten smaller websites but larger ones. One point that supports this conclusion is that Akamai does not state the cost of its threat prevention service. Only large websites could work with Akamai or Malwarebytes on this issue.

So, are there ways to deal with it or avoid it?

There are ways to deal with it. A basic one is prevention, which includes using prevention systems and security rules that stop the hacker from gaining access to a website.

Another way is to use advanced cybersecurity systems from companies in the industry. Besides Akamai and Malwarebytes, many other companies are active in this field, each with its own product that could help in this situation.

Avoiding it is the hard part. Only a highly experienced cybersecurity technician could spot a Magecart skimmer. The chances of an average user noticing that something is wrong are very small.

One solution would be to pay with other payment methods, such as PayPal, so that you do not give your card details to every online store.

Comment by Olet – A side note

Many online stores save your card details on their own “secure” server. Have you thought about what will happen if the online store you give these important details to gets hacked? Always choose the most secure payment method, not the most convenient one.

But PayPal or similar payment methods are not always available, nor are they the perfect solution. In that case, all you can do is enable a 2FA (Two Factor Authentication) method for your card payments, if one is available, so that you block unauthorized purchases even if your card details are stolen.

If there is no 2FA method, you are left hoping that nothing goes wrong.

Comment by Olet – A side note

The Magecart case shows you that the argument that “online transactions are secure” is completely unfounded and is disproved every day. Online transactions are secure up to a point. Electronic money will NEVER be completely secure and will ALWAYS be less secure than physical cash.