Digital attackers invented two new evasion techniques that they can use to help conceal the activity of a client-side web skimmer.

As reported by Malwarebytes, a security researcher disclosed the first publicly documented payment card web skimmer to ever use steganography on Dec. 26, 2019. They found that the skimmer used what appeared to be a free shipping ribbon commonly found on e-commerce websites. However, a closer look at the image revealed that the file contained malicious JavaScript code immediately after the file marker. That code, in turn, was responsible for the credit card skimming functionality.

The firm noted that the same security researcher also observed some digital attackers using WebSockets with their payment card skimmers. As opposed to HTML, this communication protocol allowed digital attackers to exchange data with their skimmer over a single TCP connection. This functionality enabled the malicious actors to exchange the skimming code and data exfiltration attempts with their skimmer using bidirectional messages.

The Latest Innovation in Skimmers

This isn’t the first time that digital attackers have innovated new techniques for the typical web skimmer. Back in mid-November, Visa revealed that it had detected a new skimmer called Pipka targeting at least 17 e-commerce websites. That malware used a variety of anti-analysis techniques at the time of discovery; chief among them was its ability to remove its script tag and thereby make itself more difficult to detect. It was just a few days later when Malwarebytes reported that attackers had started blending phishing and skimming tactics together to trick users into thinking they were using a legitimate payment service platform.

How to Defend Against a Web Skimmer

Security professionals can help defend against an evasive web skimmer by investing in solutions that are powered by machine learning (ML). They can then train those models on a variety of scenarios, including attack chains involving the use of evasive behaviors, to help better protect the network against sophisticated digital threats. Security professionals should also review their data loss and protection strategies to make sure their organization can still access its critical information in the event of an adversarial ML attack.

More from

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…