Researchers from Malwarebytes warns that the Magecart skimming campaign is active, but the attacks are more covert.
Magecart threat actors have switched most of their operations server-side to avoid detection of security firms. However, Malwarebytes researchers warn that the Client-side Magecart attacks are still targeting organizations, but are more covert.
The researchers recently uncovered two domains, “scanalytic[.]org” and “js.staticounter[.]net,” belonging to the Magecart infrastructure on the same ASN (AS29182) that was used by the cybercriminals.
Malwarebytes linked the 2 domains with a previous campaign from November 2021 which was characterized by the first use of a software skimmer designed to check the execution within a virtual machine.
The experts also noticed that the threat actors have now removed the VM detection code, perhaps because it caused more issues than benefits.
The discovery of additional domains linked to the same infrastructure suggests the campaign dates back to at least May 2020.
- hal-data[.]org/gre/code.js (Angular JS)
- hal-data[.]org/data/ (Logger)
- js.g-livestatic[.]com/theme/main.js (Modernizr)
The researchers explained that they have generally seen less skimming attacks during the past several months, perhaps because they were more focused on the Magento CMS.
(SecurityAffairs – hacking, Magecart)
The post Magecart attacks are still around but are more difficult to detect appeared first on Security Affairs.