NewsJuly 13, 2017 @ 11:05 AM

Let’s Get Physical: Malicious Script Magecart Expands Impact With Fraudulent Mail Forwarding

In October 2016, multiple security firms discovered a new strain of e-commerce malware: Magecart. So named because it goes after large-scale platforms including Magento commerce, Powerfront CMS and OpenCart, the attack relied on malicious script injected into sites using a known compromise.

Almost a year later, Magecart remains a serious problem for companies that don’t regularly update their e-commerce software or track security alerts. According to Help Net Security, the malware is now getting physical by reshipping fraudulently bought goods to avoid suspicion and increase total profits.

Jumpin’ Java

Like many e-commerce exploits, Magecart starts with JavaScript. Once injected, new scripts let attackers hook into web forms and record all data entered by users. In addition, cybercriminals are able to insert extra fields into these web forms and gather additional data, which lets them authenticate user details and quickly monetize information.

As noted by the Enterprise Times, this isn’t messy, quick-hitter malware. Attackers use secure HTTPS connections to exfiltrate data and then host it on remote sites, which also encrypt via HTTPS. Since the primary target of Magecart is smaller businesses, this method provides the best chance of success: Most small or midsized businesses can’t afford the staff and technology to effectively crack HTTPS-protected transmissions.

Researchers also found that Magecart developers have been hard at work testing their malware, increasing its scope, developing new features, obfuscating attack methods and attempting to hide their actions behind commonplace technologies. Put simply, the fraudsters are committed to full-on e-commerce fraud.

Monetizing Malicious Script via Mules

If the malicious script stopped there — securely exfiltrating consumer credit data from small e-commerce sites that weren’t properly updated — it would be enough to keep the malware-makers in business through the foreseeable future. But according to Information Age, there’s another layer to this larcenous effort: The server behind the IP address currently used for Magecart-script injection also links to a reshipping company falsely billed as a freight and logistics provider. The fake site advertises on Russian job-seeker pages for U.S.-based agents who are eventually shipped physical goods. The agents then reship them to addresses in Eastern Europe.

It’s a good scam, since physical goods such as electronics can travel with relative ease between countries and continents, while high-value cash transfers or large-scale credit purchases raise red flags online. By leveraging stolen credit data to purchase innocuous physical goods, recruiting Americans as shipping mules and then selling off high-priced items for a profit, the Magecart-makers have effectively compromised the entire supply chain.

With chip-and-PIN now making headway in the U.S., malicious actors are turning to card-not-present (CNP) fraud online, prompting the rise of Java-based keyloggers to obtain credit data and continually compromise users. The addition of physical goods fraud and reshipping puts the onus on companies using e-commerce sites: Apply the latest updates and watch security warnings to prevent malicious actors crossing the digital/physical divide.

Share this Article:
Douglas Bonderud

Freelance Writer

A freelance writer for three years, Doug Bonderud is a Western Canadian with expertise in the fields of technology and innovation. In addition to working for the IBM Midsize Insider, The Content Standard and Proteomics programs for Skyword, Doug also writes for companies like Ephricon Web Marketing and sites such as MSDynamicsWorld. Clients are impressed with not only his command of language but the minimal need for editing necessary in his pieces. His ability to create readable, relatable articles from diverse Web content is second to none. He has also written a weekly column for TORWars, a videogaming website; posts about invention and design for InventorSpot.com and general knowledge articles for WiseGeek. From 2010-2012, Doug did copywriting for eCopywriters.com. Doug is currently a municipal police officer, on track to become a fantasy/sci-fi author.