January 14, 2020 By David Bisson 2 min read

A website set up to collect donations for the Australian bushfires suffered a Magecart credit card skimming attack.

According to Bleeping Computer, digital attackers used a Magecart credit card skimming script to compromise a website that’s collecting donations for the Australian bushfires. The attack caused a malicious skimmer called ATMZOW to activate whenever a visitor to the site added an item such as a pre-determined donation amount to their cart and proceeded to checkout. When a visitor submitted their payment card credentials, ATMZOW stole the submitted information and exfiltrated it to vamberlo[.]com.

Malwarebytes researchers detected the attack and succeeded in shutting down vamberlo[.]com. This action freed individuals to begin using the site again without fear of having their payment card credentials compromised. Even so, the security firm’s researchers noted that those actors responsible for the attack could reactivate their skimmer by modifying it to work with another domain.

The Growing Threat of Magecart

The compromise described points to the growing threat of Magecart attacks. In October 2019, RiskIQ provided a glimpse into the state of Magecart. The security firm found that 17 percent of malvertisements contained Magecart skimmers and that these scripts, once activated, tended to remain active anywhere from 22 days to many years on the breached sites.

It’s no surprise that the FBI issued a warning about web skimming to small- and medium-sized businesses just a few weeks later in response. Not long thereafter, Malwarebytes observed that malicious actors had begun outfitting their Magecart skimmers with new evasion techniques to make detection of their compromises even more difficult.

How to Defend Against a Credit Card Skimming Attack

Security professionals can help defend their organizations against credit card skimming attacks by adopting a zero-trust model with JavaScript/JScript. Doing so will help block access to sensitive data in web forms commonly found in websites’ checkout processes. Security teams should also avoid third-party code, use extension blacklists and follow other Magecart mitigation tips.

 

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today