Protect Your E-commerce Website from Web Skimmer Attacks

Recent cybersecurity research has uncovered a highly concerning Magecart-style web skimmer campaign that poses a significant threat to e-commerce websites. This ongoing attack employs a unique approach, utilizing hijacked sites as makeshift command-and-control (C2) servers, allowing cybercriminals to distribute malicious code undetected. In this article, we will delve into the details of this campaign and highlight the importance of enhanced security measures to safeguard your online business and protect your customers' personal data.
​
The Threat: The web security company Akamai has identified victims of varying sizes across North America, Latin America, and Europe. This widespread attack puts the personal data of thousands of site visitors at risk, as the attackers aim to harvest and sell this information for illicit profits. To evade detection, the attackers utilize various techniques, including obfuscating the attack through Base64 encoding and masquerading the malicious code as popular third-party services like Google Analytics or Google Tag Manager.

Compromised Legitimate Sites and Vulnerable E-commerce Websites: Instead of hosting the malicious code on their own flagged domains, the attackers compromise legitimate sites and hide their code within them. This strategy creates two types of victims: compromised legitimate sites acting as distribution centers for malware and vulnerable e-commerce websites targeted by the skimmers. Some websites not only suffer data theft but also unknowingly become vehicles for spreading the malware to other susceptible websites.

Exploiting E-commerce Platforms: The attack specifically targets popular e-commerce platforms such as Magento, WooCommerce, WordPress, and Shopify, highlighting the increasing variety of vulnerabilities found in these digital commerce platforms. The attackers exploit the trust that these websites have built over time, making it challenging to identify and respond to these attacks effectively.

Advanced Techniques and Evasive Behavior: To minimize their footprint and reduce the likelihood of detection, the attackers use JavaScript code snippets that act as loaders to fetch the full attack code from the host victim website. This obfuscated skimmer code comes in two different variants and is designed to intercept and exfiltrate personally identifiable information (PII) and credit card details. The attack's evasiveness is further enhanced by ensuring that exfiltration only occurs once for each user during the checkout process, reducing suspicious network traffic and making detection even more difficult.

​The discovery of a web skimmer attack targeting popular e-commerce platforms emphasizes the urgent need for enhanced security measures. Cybercriminals are continuously evolving their tactics to exploit vulnerabilities and compromise online businesses. By staying informed and proactive, you can mitigate the risks and protect your customers' sensitive information. Don't wait until it's too late! Schedule a FREE consultation today with our expert team to discuss how our Web Application Firewall services can fortify your website against Magecart-style attacks and other cyber threats. Take proactive measures to secure your online business and ensure a safe shopping experience for your customers. Contact us now to get started.