Did your company or e-commerce firm recently buy third-party software from a value-added reseller (VAR) or systems integrator? Did you vet the vendor code? If not, you could be at risk for a Magecart group attack.

Magecart is an association of threat actor groups who target online shopping carts, mostly from within the e-commerce platform Magento. The Magecart name is derived by combining ‘Mage’ (from Magento) with ‘cart’ (shopping cart). This type of attack is especially dangerous as it only takes one line of code to steal payment card data.

Magecart attacks can compromise a piece of third-party software from a VAR or systems integrator. Recently, they’ve been infecting a variety of supply chain processes.

Let’s take a closer look at this malicious attack vector and how it has evolved over time. Later, we’ll explore ways you can protect your business and customers from Magecart attacks.

Magecart: Just One Line of Code

Back in 2015, Magecart made global headlines with a series of high-profile attacks targeting some big names in air travel, ticketing and retail.

In the classic Magecart attack, threat actors insert a single line of malicious code, such as a JavaScript sniffer. Once installed, whenever a user lands on the compromised website’s shopping cart or checkout page, the code downloads the JS sniffer. From there, attackers can intercept any information entered onto the page and send the data to the attacker.

This type of credit card number decoder attack is also known as a credit card skimmer, digital skimmer, web skimmer or formjacking.

Magecart can skim anything entered into an online data form, such as card numbers, expiration dates, CVC codes, names, addresses, phone numbers, email addresses and so forth. This data can then be used for identity theft or fraud. In other cases, it ends up for sale on the darknet.

Moving to Third-Party Targets

At first, Magecart targeted specific businesses, large and small alike. More recently attackers have pivoted to target advertising supply chains. Researchers have detected skimming scripts on thousands of websites of all kinds, from flight booking services to retail, cosmetic, health care and apparel companies.

In this version of the attack, instead of specific businesses, threat actors target vendors that supply code that enhances website functionality. For example, web-based ad software suppliers work with thousands of clients. This means the vendor spreads the infected code for the attackers without knowing about it.

Anyone relying on a third-party vendor for part of their website code is at risk. If you drop in code for analytics, you might also insert Magecart payload into your website.

More recently, attackers have even used hosting services as vectors to infect client sites with Magecart. Attackers also cloak malicious code by hiding script in the metadata of image files or authentic CSS files. As a detection technique, some even seek an online steganography decoder service in an attempt to reveal hidden code.

Magecart Supply Chain Threat

As mentioned, for every third-party software vendor there might be another Magecart attack. For instance, a single vendor can provide ticketing, touring and booking services to hundreds of clients. Next, attackers could compromise any kind of media or entertainment site due to infected code. Infected content could also arrive through a content delivery network (CDN). In essence, any website that engages in transactions online or that collects user data could be breached by Magecart.

When Magecart first appeared in 2015, the primary target was open-source Magento e-commerce platforms. Today, the threat is more and more expansive across a wide variety of software categories. One multi-functional script was discovered to be skimming data from a whopping 57 different payment platforms.

Ant and Cockroach Skimmer

Magecart groups most often use the ant and cockroach technique. It involves the following:

  • Separate ‘loader’ and ‘skimmer’ code
  • Checks to target URLs linked to checkout pages with developer tools disabled
  • “Radix” obfuscation technique disguises skimming code
  • Attackers often make slight tweaks to malicious code to avoid detection.

Magecart attacks continue to increase in scope and sophistication. E-commerce and supply chain businesses face increasing pressure to protect their websites against these threats.

Stopping Magecart Attacks

While there’s no magic bullet to prevent skimming attacks, there are some tools and strategies that can help improve and harden your security.

Zero Trust

Consider adopting a zero-trust approach with JavaScript on your sites. This begins with a policy to block access by default to any sensitive information entered in web forms and stored cookies. From there, only a select set of vetted scripts (mostly ones that you author and/or own) is allowed to access sensitive data. If malicious skimming code does infect your site, it’s less likely to access any of the sensitive information.

Third-Party Risk Management

Directed third-party risk management creates a centralized, tightly mapped structure of third-party risk hierarchy including risks, controls, locations and regulations. These models support third-party categorization based on risk, criticality and other factors. Configurable methodologies can assess and score inherent and residual third-party risks. This includes capturing detailed vendor risk data, including severity, impact, mitigating plans and other issues.

Subresource Integrity

Subresource Integrity enables browsers to verify that the resources they fetch are delivered without unseen manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.

Subresource Integrity enables you to mitigate attack risk by ensuring that the files your web application or web document fetches (such as from a CDN) have arrived without a third-party having injected any additional content or changes into those files.

Content Security Policy

Content Security Policy is an added layer of security that helps to detect and mitigate certain types of attacks, including cross-site scripting and data injection attacks. These attacks are used for everything from data theft to site defacement to malware distribution.

Protect Your Business & Customers

The worst thing you can do is pretend like Magecart attacks don’t exist, or think you can’t be affected. If you use third-party software to collect data on your site, it pays to look into protection efforts against Magecart.

More from Data Protection

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Defensive Driving: The Need for EV Cybersecurity Roadmaps

As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting from Point A to Point B. They also offer a new path for network compromise that could put drivers, companies and infrastructure at risk. To help address this issue, the Office of the National Cyber Director (ONCD) recently hosted a…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

How the CCPA is Shaping Other State’s Data Privacy

Privacy laws are nothing new when it comes to modern-day business. However, since the global digitization of data and the sharing economy took off, companies have struggled to keep up with an ever-changing legal landscape while still fulfilling their obligations to protect user data. The challenge is that there is no one-size-fits-all solution regarding data privacy's legal requirements. Depending on the location and jurisdiction, data privacy laws can vary significantly in terms of scope and enforcement. But while the laws…