New Magecart Attack Inject Malicious JavaScript to Skim Payment Data

Cybersecurity: New Magecart Campaign Targets Ecommerce Payment Data

A recent Magecart-style campaign has been identified, targeting ecommerce platforms through the deployment of malicious JavaScript designed to harvest payment information. This campaign involves the injection of concealed scripts into compromised websites, enabling attackers to intercept sensitive data during the checkout process.

Magecart attacks pose a substantial risk to online retailers and their customers. These campaigns have evolved over time, with cybercriminals continually enhancing their techniques to evade detection. The latest iteration employs advanced obfuscation methods, complicating efforts by security teams to detect and neutralize the malicious code.

Security analyst Himanshu Anand discovered this campaign using open-source threat intelligence, tracing it to a primary domain, cc-analytics.com, which hosted the malicious JavaScript. This indicates a coordinated effort to distribute similar payloads across various ecommerce platforms, suggesting a widespread impact on numerous online businesses.

The compromised data is transmitted to attacker-controlled servers, where it can be used for fraudulent activities. This campaign highlights how attackers exploit trusted ecommerce environments, compromising customer data during online transactions.

How the Attack Infection Mechanism Works

The malicious JavaScript operates through a multi-stage process that remains undetected by users and administrators. When a shopper visits a compromised site, the attacker's script loads silently via a script tag injected into the webpage's HTML.

Once active, the script targets specific form fields to capture sensitive information. It monitors checkout buttons and payment form elements, capturing real-time data entry. This information is exfiltrated instantly to domains like pstatics.com before reaching legitimate payment gateways.

The attack remains invisible, avoiding browser security warnings and detection by automated security tools due to its obfuscation techniques. This allows the script to persist on compromised sites, continuously harvesting data from unaware customers.

Based on reporting by Cyber Security News.