We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

New Magecart Campaign Potentially Affects Thousands

New Magecart Campaign Potentially Affects Thousands
Zane Kennedy Published on 6th June 2023 Cybersecurity Researcher

A global Magecart attack has wreaked havoc on numerous eCommerce websites, compromising thousands of customers' personal data and credit card information.

The sophisticated cybercriminal group responsible for the attack has been injecting malicious scripts into legitimate websites, including WooCommerce, WordPress, and Shopify, allowing them to intercept the sensitive information of customers during online transactions.

Security researchers from Akamai have been closely monitoring the campaign, affecting organizations in multiple countries, including the United States, the United Kingdom, Australia, Brazil, Peru, and Estonia. In many instances, the attackers managed to skim credit card data and other identifying information for months without being detected.

In an interesting strategy, the Magecart attackers use some compromised sites as makeshift command and control (C2) servers, hosting and distributing credit card skimmers to other vulnerable commerce sites without having to set up their own infrastructure, which carries a higher risk of detection.

Targeted sites are delivered with small JavaScript snippets, which fetch the full malicious code from one of the attackers compromised “host” sites. This allows the attackers to conceal the majority of the code used in the Magecart attack.

To further evade detection, the threat actors have encoded the skimmer with Base64 encoding, making it challenging to trace its origins and purpose. Additionally, the skimmer's structure closely resembles popular third-party services like Google Tag Manager or Facebook Pixel, blending seamlessly into targeted websites.

Akamai's research identified two variants of the skimmer used in this campaign. The first variant employs heavy obfuscation techniques. It includes a customized list of CSS selectors targeting input fields for personally identifiable information (PII) and credit card details on compromised sites.

The second variant wasn’t as obfuscated as the first, helping researchers more accurately map the campaign's reach and identify additional victims.

Once the skimmer successfully extracts customers' data, it is sent to the attackers' server through a straightforward HTTP request, initiated upon the creation of an IMG tag in the skimmer code. The stolen information is obfuscated using Base64 encoding, minimizing the chances of detection.

Website owners are advised to enhance security measures by safeguarding admin accounts and regularly updating content management systems (CMS) and plugins. Customers can reduce their risk by utilizing electronic payment methods, virtual cards, or setting charge limits on credit cards.

The scale and duration of this Magecart-style campaign have raised concerns among cybersecurity experts. Countless digital commerce websites, including high-traffic platforms, have fallen victim to the attack, potentially exposing thousands, if not tens of thousands, of customers' credit card data.

The attackers' use of compromised legitimate websites as hosts for the malicious code presents a significant challenge for detection and response efforts. Leveraging established reputations and trust, the Magecart group has successfully concealed their activities, making it challenging to identify and combat these attacks.

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.