Magecart Hackers Infect 17,000 Sites Through Misconfigured Amazon S3 Buckets

Magecart strikes again!

Cybersecurity researchers have identified yet another
supply-chain attack carried out by payment card hackers against
more than 17,000 web domains, which also include websites in the
top 2,000 of Alexa rankings.

Since Magecart^[1] is neither a single
group nor a specific malware instead an umbrella term given to all
those cyber criminal groups and individuals who inject digital card
skimmers^[2] on compromised websites,
it is not necessary for every one of them to use similar techniques
with the same sophistication.

A new report
shared with The Hacker News prior to its release details a new
supply-chain attack campaign wherein hackers are using shotgun
approach instead of targeted attacks to infect a wide range of
websites, preferring larger infection reach as possible over
accuracy.
^[3]

Almost two months ago, security researchers from RiskIQ discovered
supply-chain attacks involving credit card
skimmers placed on several web-based suppliers, including
AdMaxim, CloudCMS, and Picreel intending to infect as many websites
as possible.

However, upon continuous monitoring of their activities,
researchers found that the actual scale of this campaign, which
started in early April 2019, is much larger than previously
reported.

Magecart Hackers Target Misconfigured Amazon S3 Buckets

According to the researchers, since the beginning of the campaign,
this group of Magecart attackers has continuously been scanning the
Internet for misconfigured Amazon S3 buckets, which allows anyone
to view and edit files it contains, and injecting their digital
card skimming code at the bottom of every JavaScript file they
find.

Since the hackers don’t always have the idea if the overwritten
javascript files are being used by a website or a project, it’s
more like shooting an arrow in the dark.
Moreover, it appears that many of the infected JavaScript files
were not even part of the payment page, which is the primarily
targeted location from where digital skimmers capture users’
payment card details and send them to an attacker-controlled
server.

If you read The Hacker News regularly, you may already know that
hardly a week goes by without hearing about a company that left its
sensitive data
exposed on the Internet, and unfortunately, most of them are
the one that failed to configure [1, 2] their Amazon S3 buckets properly.

Heavily Obfuscated Malicious JavaScript Card-Skimmer

Meanwhile, in a separate report released
today by the Zscaler ThreatLabZ research team, researchers disclose
details of a newly discovered Magecart campaign where attackers are
using a sophisticated and targeted approach to steal credit and
debit card details from e-commerce sites.

According to the report, instead of making use of digital
skimming code in plain JavaScript, the group has been found using a
heavily obfuscated version of its card-skimmer with encrypted
payloads in an attempt to prevent researchers from easily identify
the compromised websites.

Magecart made headlines last year after payment card hackers
conducted several high-profile attacks against major international
companies including British
Airways, Ticketmaster,
and Newegg.

For failing to protect the personal information of around half a
million of its customers during last year’s security breach,
Britain’s Information Commissioner’s Office (ICO) just yesterday
hit British Airways with a record fine of
£183 million^[10].

^{[4][5][6][7][8][9]}