December 14, 2018 By Shane Schick 2 min read

An online retailer was hit by a JavaScript attack from a group associated with Magecart, a collective of cybercriminals that specializes in skimming credit card numbers from compromised websites, according to malware researchers at BroadAnalysis.

BroadAnalysis did not reveal the name of the online retailer in question, but posted a series of screenshots that showed the network traffic, index page and four different sniffer scripts used in the attacks. These included an exfil script, a loading script and a base64 string that linked the compromised site and stolen payment credentials back to the threat actor’s site.

The JavaScript attack is typical of Magecart, which has been linked to similar attacks aimed at e-commerce platforms such as Magento and OpenCart.

Skimming at Sotheby’s and Others

The discovery of the four different credit card skimmers comes less than a month after the auction house Sotheby’s sent a statement to several IT security publications about a similar Magecart attack against its Sotheby’s Home website (formerly Viyet) discovered in early October. The firm warned that the JavaScript attack may have been running and stealing customer payment data since March 2017.

Another security research report, meanwhile, suggested that a Magecart group has evolved its use of skimming tools to not only steal customer credit card data, but also website administrator credentials. This involves adding other keywords into the skimmer code to look for admin logins and passwords as well as the payment forms on e-commerce sites. Researchers discovered the technique in the analysis of a skimming campaign against an optical retailer’s e-commerce site.

How to Protect Your Organization From a JavaScript Attack

Although Magecart attacks can happen at any time, retailers should be particularly vigilant about this sort of JavaScript attack as more consumers turn to online purchases during the busy holiday shopping season.

Defending against this kind of threat starts with applying common best practices, such as limiting access and privileges for critical systems and hardening underlying web servers. Beyond that, organizations should also deploy change monitoring and detection technologies that can alert security teams of unusual activity, such as a change in their e-commerce web pages.

Sources: BroadAnalysis, SC Magazine, RiskIQ

More from

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure."The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024, President…

How a new wave of deepfake-driven cybercrime targets businesses

5 min read - As deepfake attacks on businesses dominate news headlines, detection experts are gathering valuable insights into how these attacks came into being and the vulnerabilities they exploit.Between 2023 and 2024, frequent phishing and social engineering campaigns led to account hijacking and theft of assets and data, identity theft, and reputational damage to businesses across industries.Call centers of major banks and financial institutions are now overwhelmed by an onslaught of deepfake calls using voice cloning technology in efforts to break into customer…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today