Pierluigi Paganini
March 25, 2020
Hackers have compromised the website of the popular vendor of plastic food container products Tupperware implanting a payment card skimmer used to steal customers’ payment card details. The official website has approximately 1 million monthly visits on average.
The malicious code was also discovered in
According to Malwarebytes, the malicious code remained active on the Tupperware homepage for at least five days, the experts first discovered the malicious code on March 20.
The researchers attempted to notify Tupperware without success.
According to Malwarebytes, the malicious code on Tupperware’s website works by mimicking the company’s official payment form.
“During one of our web crawls, we identified a suspicious-looking
The inspection of the checkout page revealed the presence of an
The fake form collects payment data entered by users and sends them to a remote server under the control of the attackers. The malicious code steal first and last name, billing address, telephone number, credit card number, credit card expiry date, and credit card CVV code.
“The criminals devised their skimmer attack so that shoppers first enter their data into the rogue iframe and are then immediately shown an error, disguised as a session time-out.” continues the analysis.
“This allows the threat actors to reload the page with the legitimate payment form. Victims will enter their information a second time, but by then, the data theft has already happened.”
Tupperware addressed the issue, now the payment form is currently loading from the legitimate domain cybersource.com.
The experts from Malwarebytes speculate that the website was hacked because it was running an outdated version of Magento e-commerce CMS.
“We do not know exactly how Tupperware got hacked, but a scan via Sucuri’s SiteCheck shows that they may be running an outdated version of the Magento Enterprise software.” concludes Malwarebytes.
“Like any website compromise, it is important to look for the root cause by inspecting server side logs and determine if the attackers still have access. Often times, criminals will leave
According to the experts, Magecart-style attacks are expected to increase in the coming months, hackers will attempt to monetize the significant increase in the number of online purchases due to the COVID19 outbreak.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(
[adrotate banner=”5″]
[adrotate banner=”13″]
