Magecart Skimmers Spotted on 2M Websites
Researchers say supply chain attacks are responsible for the most significant spikes in Magecart detections.
Credit card-skimming threat Magecart has reportedly compromised more than 2 million victim websites and directly breached more than 18,000 hosts, RiskIQ researchers report.
Magecart is a rapidly growing cybercrime syndicate made up of several groups, all of which specialize in digital credit card theft via payment form skimmers. Attackers either gain direct access to websites or through other third-party services in supply chain attacks. Malicious JavaScript is implanted into the site's code and lifts the data shoppers enter in payment forms.
RiskIQ's first observation of Magecart was back in 2010, but the threat has recently been ramping up as more attackers learn how to compromise websites. Supply chain attacks are responsible for the biggest spikes in Magecart detections, the largest of which took place on June 27, 2018, when Ticketmaster reported a breach conducted by Magecart. Third-party shopping platforms like Magento and OpenCart remain popular Magecart targets; RiskIQ has detected 9,688 vulnerable Magento hosts, researchers say in a new report on the threat.
Some groups are taking advantage of digital advertising to bring more traffic to infected checkout pages: Seventeen percent of all malvertisements detected by RiskIQ are controlled by Magecart.
The average length of a Magecart breach is 22 days; however, many last years and some are indefinite. Its infrastructure contains 573 known command-and-control domains and 9,189 hosts observed loading C2 domains. There are now dozens of known Magecart groups, and researchers have begun connecting some of these groups with known cybercrime groups.
Read more details of the report, "Magecart: The State of a Growing Threat," here.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Rethinking Cybersecurity Hiring: Dumping Resumes & Other 'Garbage.'"
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024