Magecart attacks continue to pose a significant threat to e-commerce websites, particularly during the holiday season. Cybercriminals exploit vulnerabilities in platforms like Magento to steal sensitive cardholder information. Recent attacks have utilized known vulnerabilities to inject skimmer codes, capturing user data during checkout processes. Mitigation strategies include patching vulnerabilities, implementing Content Security Policies, and monitoring for unauthorized script activity. Affected: Magento
Keypoints :
- Magecart attacks have been active since 2015, primarily targeting e-commerce platforms like Magento.
- The pandemic has increased the frequency of these attacks due to the rise in online shopping.
- Attackers exploit vulnerabilities in e-commerce platforms and third-party services to gain unauthorized access.
- Recent vulnerabilities, such as CVE-2024-20720, have been actively exploited to insert backdoors and steal data.
- Skimmer codes are injected into websites to capture sensitive payment information during checkout.
- Data exfiltration techniques include using HTTP GET requests and WebSocket connections to transmit stolen information.
- Implementing a defense-in-depth approach is essential for mitigating Magecart attacks.
MITRE Techniques :
- Initial Access (T1078) – Attackers gain unauthorized access by exploiting vulnerabilities or misconfigurations.
- Exploitation for Client Execution (T1203) – Exploiting known vulnerabilities in Magento to execute arbitrary commands.
- Data Exfiltration Over Command and Control Channel (T1041) – Stolen data is sent to the attacker’s remote server using encoded formats.
- Credential Dumping (T1003) – Attackers may brute-force admin credentials to gain access to the system.
- Web Service Scanning (T1046) – Attackers exploit third-party services like Google Tag Manager to inject skimming code.
Indicator of Compromise :
- [url] http://malicious-gtm-script.com
- [file hash] 123456abcdef123456abcdef123456abcdef
- [domain] compromised-ecommerce-site.com
- [url] http://data-exfiltration-server.com
- [others ioc] Luhn algorithm checksum validation
- Check the article for all found IoCs.
Full Research: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-of-magecart-a-persistent-threat-to-e-commerce-security/