Multi-platform card skimmer targets Shopify, BigCommerce, Zencart, and Woocommerce stores

Experts warn of a multi-platform credit card skimmer that can target online stores running on Shopify, BigCommerce, Zencart, and Woocommerce.

Security experts have discovered a multi-platform credit card skimmer that can allow threat actors to harvest payment info on compromised stores powered by Shopify, BigCommerce, Zencart, and Woocommerce.

Researchers from security firm Sansec discovered that the new software skimmer is able to interact with the checkout process on shops running on top of multiple online store management systems.

The software skimmer can also target e-stores running on BigCommerce and Shopify platforms even if they do not allow custom Javascript on checkout pages. This skimmer shows a fake payment form that was designed to record customer keystrokes before they enter the actual checkout page. 

“Hosted platforms like BigCommerce and Shopify do not allow custom Javascript on checkout pages. This skimmer evades that by showing a fake payment form and recording customer keystrokes before they enter the actual checkout page.” reads the post published by SanSec. “Once the data is intercepted, the skimmer displays an error message and the customer is redirected to the real payment page:”

Once the customers have provided their credit card data, the skimmer will throw an error and redirects customers to the real payment page to avoid raise suspicion.

This campaign outstands because it targets so many different platforms, hackers may have breached a shared component used by all affected merchants.

Experts pointed out that this multi-platform skimmer uses programmatically generated exfiltration domains.

“It keeps a counter and uses base64 encoding to produce a new domainname.” continues the report. “This will lead to, for example, these exfiltration domains.”

• zg9tywlubmftzw5ldza.com;
• zg9tywlubmftzw5ldze.com;
• zg9tywlubmftzw5ldzu.com:
• zg9tywlubmftzw5ldzq.com;
• zg9tywlubmftzw5ldzm.com;
• zg9tywlubmftzw5ldzy.com;
• zg9tywlubmftzw5ldzi.com;
• zg9tywlubmftzw5ldzg.com
• …………………………………………..

The first exfiltration domains was registered on August 31, 2020.

“To summarize: this campaign shows that platforms are no boundary to the profitable fraud of online skimming,” Sansec concludes. “Wherever customers enter their payment details, they are at risk.”

Sansec researchers have spotted multiple Magecart campaigns using new evasion techniques. In early December they have uncovered a campaign that was hiding the malware in CSS files.

The experts analyzed multiple Magecart attack techniques over the past months, attackers compromised websites by hiding malicious code in multiple components of the sites, including live chat windows, images, and favicons.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Multi-platform card skimmer)

[adrotate banner=”5″]

[adrotate banner=”13″]