Buying products or services online always comes with a measure of risk. Does the business properly secure and store credit card data? Does it take steps to protect against cyberfraud?

While most companies recognize the need for PCI DSS-compliant policies and safe data handling, a recent CSO Online article noted another rising risk: malicious JavaScript. Nearly 6,000 online shops have been compromised by this code, which is specifically designed to intercept and steal payment card information.

Is Malicious JavaScript a Long-Term Threat?

This isn’t a new threat. Back in 2015, Dutch researcher Willem de Groot reported these online skimming tactics at more than 3,500 stores. But despite his warning, the situation hasn’t improved. The total number of affected stores has nearly doubled, and of the 3,500 originals, 750 are still putting customer credit card data at risk.

Here’s the problem: This malicious JavaScript not only targets pages with “checkout” in the URL, but also goes after payment plugins like Fire Checkout and PayPal to swipe consumer data. It’s deployed using known vulnerabilities in content management and e-commerce platforms to effectively get behind both HTTP and HTTPS-protected sites and grab information, but many companies don’t recognize the seriousness of the issue.

Some claim that since payments are handled by third parties, it’s not their problem, while others rely on HTTPS to safeguard their interests. But since this JavaScript is installed behind HTTPS at the server level, all information users enter into the checkout page is up for grabs. While 334 stores fixed their issues after the news broke last week, 170 new stores were later hacked.

Laying Down the Law

So how do companies protect their credit card data from malicious JavaScript and other attacks? They can start by recognizing that no e-commerce service is truly safe. Known vulnerabilities open holes for malware to slip through, and attackers are always looking for new ways to compromise lucrative payment portals.

In addition, companies need to consider the use of reliable third-party monitoring and detection tools that can alert them to possible avenues of compromise and help limit their total risk — an essential step given the increasing regulation of personal data storage, transmission and security.

Better consumer data protection will also demand more active involvement from big players in the online space. As noted by Fox Business, for example, search giant Google is rolling out a new policy as of January 2017: Any HTTP site that transmits credit card information or passwords will be considered insecure by the company’s Chrome browser.

Right now, HTTPS sites are displayed as secure and HTTP sites as neutral. Raising the threat profile on HTTP-only checkout processes should improve customer awareness and prompt greater demand for secure checkout options.

Financial data remains a high-value target for cybercriminals. Malicious JavaScript is simply the newest tool used to crack credit card information, and it reinforces the need for more active monitoring and supervision of e-commerce sites by sellers and payment processors alike.

It’s a reminder that there’s no resting on one’s laurels here, since even HTTPS is of no use if cybercriminals infect the servers directly. Companies, third parties and dominant online entities need to collectively tackle these sneaky swipers head on.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…