Rewterz Threat Alert – Magecart Attacks Hacking Websites to Steal Customer Payment Info

Severity

Medium

Analysis Summary

In MageCart attacks, hackers are compromising web sites so that they can inject malicious JavaScript scripts into ecommerce or checkout pages. These scripts then steal payment information that is submitted by a customer by sending it to a remote site under the attacker’s control. This time, though, the script injected into smith-wesson.com is coming from the URL live.sequracdn[.]net/storage/modrrnize.js as shown below.

This script is not easy to spot as it will load a non-malicious or malicious script depending on the visitor and section of the site being visited. For most of the site, the loaded JavaScript file looks like a normal 11KB and non-malicious script. However if you are using a US-based IP address, non-Linux browsers, not on the AWS platform, and at the checkout page, the script being delivered changes from 11KB to 20KB, with the Magecart portion appended to the bottom. When this script is loaded, during checkout a fake payment form will be shown. If a customer enters their payment information in this form and submits it, the payment information will first be sent to https://live.sequracdn.net/t/, which is a server that belongs to the attackers. The attackers can then log into their server and retrieve the stolen payment information.

Impact

• Theft of credit card information
• Financial loss

Indicators of Compromise

Domain Name

sanguinelab[.]net

URL

http[:]//live.sequracdn[.]net/storage/modrrnize[.]js

Remediation

• Block the threat indicators at their respective controls.
• Keep websites patched against exploitable vulnerabilities.