Pierluigi Paganini
May 28, 2024
Sucuri researchers observed threat actors using a PHP snippet WordPress plugin to install malicious code in WooCommerce e-stores and harvest credit card details.
In the campaign spotted by the experts, attackers use a very obscure WordPress plugin called Dessky Snippets, which has only a few hundred active installations at the time of writing.
Dessky Snippets is a lightweight and simple plugin that gives users the ability to easily add custom PHP code from WordPress admin.
The campaign occurred on May 11th, and the researchers observed a surge in downloads of the Dessky Snippets plugin from that same day. At this time, the WordPress plugin has over 200 active installations.
Attackers exploited the Dessky Snippets plugin to insert a server-side PHP credit card e-skimmer.
“This malicious code was saved in the dnsp_settings option in the WordPress wp_options table and was designed to modify the checkout process in WooCommerce by manipulating the billing form and injecting its own code.” reads the analysis published by Sucuri.
The malware has two main components. The first part uses a fake function named “twentytwenty_get_post_logos()” to hook into WooCommerce’s billing form. The function adds additional fields to the billing form to request credit card details earlier than usual. The second part involves an obfuscated credit card skimmer that monitors POST data for specific parameters. When the malware detects these parameters, it sends all the collected billing and credit card information to a third-party URL “hxxps://2of[.]cc/wp-content/”.
The researchers noticed that the billing form associated with the overlay used by the attackers has the autocomplete feature disabled, The fields are set with autocomplete=”off”.
Disabling the auto-fill feature on the fake checkout form is an evasion trick that reduces the chances of the browser warning users about entering sensitive information. The fields remain blank until manually filled out, making them look like regular, necessary inputs for the transaction and reducing user suspicion.
“In essence, ecommerce sites are prime targets for hackers due to the valuable data they handle.” concludes the report. “Here’s a simple guide to protect your online store:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, WordPress)
