A website set up to collect donations for the Australian bushfires suffered a Magecart credit card skimming attack.

According to Bleeping Computer, digital attackers used a Magecart credit card skimming script to compromise a website that’s collecting donations for the Australian bushfires. The attack caused a malicious skimmer called ATMZOW to activate whenever a visitor to the site added an item such as a pre-determined donation amount to their cart and proceeded to checkout. When a visitor submitted their payment card credentials, ATMZOW stole the submitted information and exfiltrated it to vamberlo[.]com.

Malwarebytes researchers detected the attack and succeeded in shutting down vamberlo[.]com. This action freed individuals to begin using the site again without fear of having their payment card credentials compromised. Even so, the security firm’s researchers noted that those actors responsible for the attack could reactivate their skimmer by modifying it to work with another domain.

The Growing Threat of Magecart

The compromise described points to the growing threat of Magecart attacks. In October 2019, RiskIQ provided a glimpse into the state of Magecart. The security firm found that 17 percent of malvertisements contained Magecart skimmers and that these scripts, once activated, tended to remain active anywhere from 22 days to many years on the breached sites.

It’s no surprise that the FBI issued a warning about web skimming to small- and medium-sized businesses just a few weeks later in response. Not long thereafter, Malwarebytes observed that malicious actors had begun outfitting their Magecart skimmers with new evasion techniques to make detection of their compromises even more difficult.

How to Defend Against a Credit Card Skimming Attack

Security professionals can help defend their organizations against credit card skimming attacks by adopting a zero-trust model with JavaScript/JScript. Doing so will help block access to sensitive data in web forms commonly found in websites’ checkout processes. Security teams should also avoid third-party code, use extension blacklists and follow other Magecart mitigation tips.


More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…