Recently, Avast’s researchers Pavel Novák and Jan Rubín posted a detailed writeup about the “Parrot TDS” campaign involving more than 16,500 infected websites. Such massive infections don’t go unnoticed by Sucuri and we immediately recognized that the infection in their writeup belonged to the campaign we internally refer to as “ndsw/ndsx” malware. We’ve been tracking… Continue reading Analysis of the Massive NDSW/NDSX Malware Campaign
Category: Obfuscation
Автоматически добавленное в WPeMatico
Credit Card Stealer Targets PsiGate Payment Gateway Software
Magento’s payment provider gateway offers functionalities for site owners to integrate stores with payment service providers. This handy feature lets a website create and handle transactions based on order details and allows for out-of-the-box integrations with payment service providers like PayPal and Braintree. Since these gateways are responsible for helping businesses accept online payment methods… Continue reading Credit Card Stealer Targets PsiGate Payment Gateway Software
Analyzing a WooCommerce Credit Card Skimmer
The number of credit card skimmers targeting WooCommerce websites has skyrocketed over the past year, and threat actors have become increasingly creative in the different ways they obfuscate their payloads to avoid traditional detection. During a recent investigation for an infected WordPress website, we discovered an obfuscated credit card stealer hiding amongst the website’s theme… Continue reading Analyzing a WooCommerce Credit Card Skimmer
X-Cart Skimmer with DOM-based Obfuscation
Our lead security analyst Liam Smith recently worked on an infected X-Cart website and found two interesting credit card stealers there — one skimmer located server-side, the other client-side. X-Cart’s e-commerce platform is not nearly as popular as Magento or WooCommerce and as a result we don’t see as many threat actors targeting it. While… Continue reading X-Cart Skimmer with DOM-based Obfuscation
Manually Identifying an X-Cart Credit Card Skimmer
During a recent investigation, a new client came to us reporting that their antivirus had detected a suspicious domain loading on their website’s checkout page. We regularly receive reports like these, as this is a telltale indicator of a credit card skimmer infection. Our research and remediation teams frequently find credit card skimmers on Magento… Continue reading Manually Identifying an X-Cart Credit Card Skimmer
WooCommerce Credit Card Skimmers Concealed In Fake Images
Our research and remediation teams have noticed an increase in WooCommerce credit card skimmers on client sites over the past few years, as detailed in past blog posts. Due to the increased number of plugins and components facilitating online payments and its ease of use, WordPress has become a common e-commerce platform — and the… Continue reading WooCommerce Credit Card Skimmers Concealed In Fake Images