Tupperware website has been compromised with a payment card skimmer

The Tupperware website, the popular manufactured of plastic food container products was infected with a payment card skimmer.

Hackers have compromised the website of the popular vendor of plastic food container products Tupperware implanting a payment card skimmer used to steal customers’ payment card details. The official website has approximately 1 million monthly visits on average.

The malicious code was also discovered in some localized versions of the official Tupperware website.

According to Malwarebytes, the malicious code remained active on the Tupperware homepage for at least five days, the experts first discovered the malicious code on March 20.

The researchers attempted to notify Tupperware without success.

According to Malwarebytes, the malicious code on Tupperware’s website works by mimicking the company’s official payment form.

“During one of our web crawls, we identified a suspicious-looking iframe loaded from deskofhelp[.]com when visiting the checkout page at tupperware[.]com. This iframe is responsible for displaying the payment form fields presented to online shoppers.” reads the analysis published by Malwarebytes.

The inspection of the checkout page revealed the presence of an iframe designed to show a cloned payment form that mimics the legitimate VISA CyberSource payment form implemented on the Tupperware’s site.

The fake form collects payment data entered by users and sends them to a remote server under the control of the attackers. The malicious code steal first and last name, billing address, telephone number, credit card number, credit card expiry date, and credit card CVV code.

“The criminals devised their skimmer attack so that shoppers first enter their data into the rogue iframe and are then immediately shown an error, disguised as a session time-out.” continues the analysis.

“This allows the threat actors to reload the page with the legitimate payment form. Victims will enter their information a second time, but by then, the data theft has already happened.”

Tupperware addressed the issue, now the payment form is currently loading from the legitimate domain cybersource.com.

The experts from Malwarebytes speculate that the website was hacked because it was running an outdated version of Magento e-commerce CMS.

“We do not know exactly how Tupperware got hacked, but a scan via Sucuri’s SiteCheck shows that they may be running an outdated version of the Magento Enterprise software.” concludes Malwarebytes.

“Like any website compromise, it is important to look for the root cause by inspecting server side logs and determine if the attackers still have access. Often times, criminals will leave PHP backdoors or can simply re-exploit the same vulnerability to get back in”

According to the experts, Magecart-style attacks are expected to increase in the coming months, hackers will attempt to monetize the significant increase in the number of online purchases due to the COVID19 outbreak.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Tupperware, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.