Pierluigi Paganini March 25, 2020

The Tupperware website, the popular manufactured of plastic food container products was infected with a payment card skimmer.

Hackers have compromised the website of the popular vendor of plastic food container products Tupperware implanting a payment card skimmer used to steal customers’ payment card details. The official website has approximately 1 million monthly visits on average.

The malicious code was also discovered in some localized versions of the official Tupperware website.

According to Malwarebytes, the malicious code remained active on the Tupperware homepage for at least five days, the experts first discovered the malicious code on March 20.

The researchers attempted to notify Tupperware without success.

According to Malwarebytes, the malicious code on Tupperware’s website works by mimicking the company’s official payment form.

“During one of our web crawls, we identified a suspicious-looking iframe loaded from deskofhelp[.]com when visiting the checkout page at tupperware[.]com. This iframe is responsible for displaying the payment form fields presented to online shoppers.” reads the analysis published by Malwarebytes.

The inspection of the checkout page revealed the presence of an iframe designed to show a cloned payment form that mimics the legitimate VISA CyberSource payment form implemented on the Tupperware’s site.

The fake form collects payment data entered by users and sends them to a remote server under the control of the attackers. The malicious code steal first and last name, billing address, telephone number, credit card number, credit card expiry date, and credit card CVV code.

“The criminals devised their skimmer attack so that shoppers first enter their data into the rogue iframe and are then immediately shown an error, disguised as a session time-out.” continues the analysis.

“This allows the threat actors to reload the page with the legitimate payment form. Victims will enter their information a second time, but by then, the data theft has already happened.”

Tupperware addressed the issue, now the payment form is currently loading from the legitimate domain cybersource.com.

The experts from Malwarebytes speculate that the website was hacked because it was running an outdated version of Magento e-commerce CMS.

“We do not know exactly how Tupperware got hacked, but a scan via Sucuri’s SiteCheck shows that they may be running an outdated version of the Magento Enterprise software.” concludes Malwarebytes.

“Like any website compromise, it is important to look for the root cause by inspecting server side logs and determine if the attackers still have access. Often times, criminals will leave PHP backdoors or can simply re-exploit the same vulnerability to get back in”

According to the experts, Magecart-style attacks are expected to increase in the coming months, hackers will attempt to monetize the significant increase in the number of online purchases due to the COVID19 outbreak.

Pierluigi Paganini

(SecurityAffairs – Tupperware, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]