E-Skimmers and Scam E-Commerce Sites Still Bite

It’s an old story: Criminals rake in serious profit by using digital “e-skimming” software, running scam e-commerce sites and selling stolen payment card data.

See Also: OnDemand | Everything You Can Do to Fight Social Engineering and Phishing

Unfortunately, it’s made continually new thanks to adaptability of cybercriminals, who manage to keep their tool set relevant and ever more lucrative.

Threat intelligence firm Recorded Future reports that 2024 saw “a surge in stolen card data, with 269 million records posted across dark and clear web platforms,” which was an increase of 70 million from 2023.

Researchers also tracked notable increases last year in:

• E-skimmer infections: Known as Magecart attack after the group that pioneered the tactic, this attack typically involves malicious code injected into legitimate e-commerce software and used to steal payment card data, for use or resale by the attacker. Last year, 11,000 e-commerce sites fell victim to such software, the researchers said, a three-fold increase from 2023.
• New tools: Many Magecart infections trace to new e-skimming tools, including one named “Sniffer by Fleras.” Such tools rapidly target known vulnerabilities.
• Scam sites: Researchers last year counted nearly 1,200 scam domains, linked to networks of scam merchant accounts largely registered in the United Kingdom or Hong Kong.
• Fashion hits: While most stolen card data, as in recent years, appeared to originate from U.S. restaurants – likely from waiters wielding pocket skimmers when taking a customer’s card to process it out of sight at a centralized point-of-sale system – researchers saw a notable increase in data tracing to online fashion stores, many of which involved scam sites purporting to sell discount clothing.
• Cybercrime forum listings: Dark web marketplaces remain viable channels for crooks to fence stolen card data, as well as tools and services, as does Telegram, although it appears to be favored by less experienced attackers.

Multiple groups use Magecart-style tactics, techniques and procedures.

Recorded Future said it tied one such group, which it tracks as “ADSWG,” to the abuse of two publicly available web services – Google Tag Manager and Amazon CloudFront – and targeting of 67 e-commerce sites operated by online jewelry retailers that share a common platform.

A Magecart attack in late 2024 involved malicious e-skimmer software being injected into a platform hosted on a content delivery network and used by hundreds of different restaurants. “Transaction analysis in collaboration with financial partners has linked approximately 50 merchants using the platform to for-sale card records on the dark web,” although with hundreds of different restaurants using the platform, the number of breach victims may well be higher, it said.

Magecart Seeks CosmicSting

Many digital skimmer hits last year occurred on the world’s most widely used e-commerce platform software Magento, as well as its enterprise version, Adobe Commerce.

In particular, many attacks targeted the “CosmicSting” vulnerability in Adobe Commerce, Magento Open Source and the Adobe Commerce Webhooks Plugin. Tracked as CVE-2024-34102, the vulnerability was first discovered by a researcher and reported to Adobe through HackerOne in January 2024. Adobe in June detailed the flaw publicly and issued patches.

The flaw, described as “a severe pre-authentication XML entity injection vulnerability” by cybersecurity research community vsociety, rated a CVSS score of 9.8, reflecting that it could be remotely exploited without user interaction.

“Successful exploitation could lead to arbitrary code execution, security feature bypass and privilege escalation,” Adobe said in its security alert.

Patching by users lagged. By early October 2024, Sansec, an Amsterdam firm that helps merchants secure their online stores, reported that 4,387 online merchants, including Cisco and National Geographic stores, had been compromised by attackers who targeted the vulnerability (see: Mass Retail Hacks Affect Adobe Commerce and Magento Stores).

The attacks continued, with a threat actor tracked as “Group Laski” later that month hitting another 1,200 stores and “Group Peschanki” running automated attacks that breached 2,000 e-commerce stores in the course of just a few hours. Another wave of attacks hit 3,000 stores in mid-November last year.

Magecart-style attackers also continued to innovate. Hackers began “using Google Translate’s page functionality to execute malicious JavaScript files,” as well as to abuse other Google services to produce JSONP – JavaScript object notation with padding – callbacks designed “to evade security measures,” Sansec said in a recent report.

One such JSONP callback attack last October involved abusing YouTube’s embed feature to compromise the official store operated by the Green Bay, Wisconsin, football team – Green Bay Packers.

Another JSONP callback campaign traced to attackers abusing the Google Discovery API to load a fake Stripe payment form onto at least 12 online stores, with the form sporting keywords suggesting it was tied to “well-known Magecart threat actor” Sansec tracks as Group Polyovki. The same group appeared to be behind another attack a few weeks later against about 100 online stores that involved abusing the Google Accounts OAuth2 API to set a fake payment location.