Digital attackers invented two new evasion techniques that they can use to help conceal the activity of a client-side web skimmer.

As reported by Malwarebytes, a security researcher disclosed the first publicly documented payment card web skimmer to ever use steganography on Dec. 26, 2019. They found that the skimmer used what appeared to be a free shipping ribbon commonly found on e-commerce websites. However, a closer look at the image revealed that the file contained malicious JavaScript code immediately after the file marker. That code, in turn, was responsible for the credit card skimming functionality.

The firm noted that the same security researcher also observed some digital attackers using WebSockets with their payment card skimmers. As opposed to HTML, this communication protocol allowed digital attackers to exchange data with their skimmer over a single TCP connection. This functionality enabled the malicious actors to exchange the skimming code and data exfiltration attempts with their skimmer using bidirectional messages.

The Latest Innovation in Skimmers

This isn’t the first time that digital attackers have innovated new techniques for the typical web skimmer. Back in mid-November, Visa revealed that it had detected a new skimmer called Pipka targeting at least 17 e-commerce websites. That malware used a variety of anti-analysis techniques at the time of discovery; chief among them was its ability to remove its script tag and thereby make itself more difficult to detect. It was just a few days later when Malwarebytes reported that attackers had started blending phishing and skimming tactics together to trick users into thinking they were using a legitimate payment service platform.

How to Defend Against a Web Skimmer

Security professionals can help defend against an evasive web skimmer by investing in solutions that are powered by machine learning (ML). They can then train those models on a variety of scenarios, including attack chains involving the use of evasive behaviors, to help better protect the network against sophisticated digital threats. Security professionals should also review their data loss and protection strategies to make sure their organization can still access its critical information in the event of an adversarial ML attack.