In October 2016, multiple security firms discovered a new strain of e-commerce malware: Magecart. So named because it goes after large-scale platforms including Magento commerce, Powerfront CMS and OpenCart, the attack relied on malicious script injected into sites using a known compromise.

Almost a year later, Magecart remains a serious problem for companies that don’t regularly update their e-commerce software or track security alerts. According to Help Net Security, the malware is now getting physical by reshipping fraudulently bought goods to avoid suspicion and increase total profits.

Jumpin’ Java

Like many e-commerce exploits, Magecart starts with JavaScript. Once injected, new scripts let attackers hook into web forms and record all data entered by users. In addition, cybercriminals are able to insert extra fields into these web forms and gather additional data, which lets them authenticate user details and quickly monetize information.

As noted by the Enterprise Times, this isn’t messy, quick-hitter malware. Attackers use secure HTTPS connections to exfiltrate data and then host it on remote sites, which also encrypt via HTTPS. Since the primary target of Magecart is smaller businesses, this method provides the best chance of success: Most small or midsized businesses can’t afford the staff and technology to effectively crack HTTPS-protected transmissions.

Researchers also found that Magecart developers have been hard at work testing their malware, increasing its scope, developing new features, obfuscating attack methods and attempting to hide their actions behind commonplace technologies. Put simply, the fraudsters are committed to full-on e-commerce fraud.

Monetizing Malicious Script via Mules

If the malicious script stopped there — securely exfiltrating consumer credit data from small e-commerce sites that weren’t properly updated — it would be enough to keep the malware-makers in business through the foreseeable future. But according to Information Age, there’s another layer to this larcenous effort: The server behind the IP address currently used for Magecart-script injection also links to a reshipping company falsely billed as a freight and logistics provider. The fake site advertises on Russian job-seeker pages for U.S.-based agents who are eventually shipped physical goods. The agents then reship them to addresses in Eastern Europe.

It’s a good scam, since physical goods such as electronics can travel with relative ease between countries and continents, while high-value cash transfers or large-scale credit purchases raise red flags online. By leveraging stolen credit data to purchase innocuous physical goods, recruiting Americans as shipping mules and then selling off high-priced items for a profit, the Magecart-makers have effectively compromised the entire supply chain.

With chip-and-PIN now making headway in the U.S., malicious actors are turning to card-not-present (CNP) fraud online, prompting the rise of Java-based keyloggers to obtain credit data and continually compromise users. The addition of physical goods fraud and reshipping puts the onus on companies using e-commerce sites: Apply the latest updates and watch security warnings to prevent malicious actors crossing the digital/physical divide.