A Magecart attack uses malicious JavaScript on an online payment page to collect card and personal details as shoppers type them in. This post covers the reported Magecart campaigns against three US online ordering platforms for restaurants, and the steps that businesses and customers can take to reduce the risk. Related reading: the FIN7threat group profile.
What Happened in the Magecart Restaurant Campaigns?
With the MageCart e-skimmer campaigns targeting three online ordering platforms, bank card information of customers of restaurants serving in the USA was reportedly seized. Online ordering platforms for restaurants allow customers to order food online and outsource the burden for restaurants to develop an ordering system. Due to its widespread use, online ordering platforms have become a high-value target for threat actors carrying out Magecart e-skimmer attacks. Magecart malware is JavaScript code that collects credit card data and other identifying information when online shoppers enter the payment page.
The campaign was reported to have started on January 18, 2022, targeting restaurants using two of the platforms. The third platform, on the other hand, was reportedly targeted by another MageCart campaign on November 12, 2021, which resulted in e-skimmer infections in restaurants using that platform. The bank card information seized in the campaign was reportedly put up for sale on Dark Web platforms.
How Can You Protect Against Magecart Attacks?
Advanced digital security technologies must be used to prevent Magecart attacks. Data Breach Monitoring services are a preferable solution to protect e-commerce sites against potential breaches. Additionally, for e-commerce providers, It is recommended to ensure that the software, hardware, and tools being used are up-to-date, request third-party service providers to have their code checked, and apply HTTP Content-Security-Policy principles which provide an additional layer of protection against potential attacks. The precautions that customers using e-commerce services should take in order not to be affected by similar security breaches are as follows;
Personal information should not be entered on unreliable/suspicious websites,
Virtual cards created for e-commerce transactions should be used,
Make sure that the visited page is not a fake domain with a similar name created by threat actors,
IOC findings such as IP addresses and domains known to be used by threat actors in these campaigns should be blocked from security solutions in use.
Frequently Asked Questions.
What is a Magecart attack?
+
It is an e-skimmer attack in which JavaScript code collects credit card data and other identifying information when online shoppers enter the payment page. CISA describes e-skimming as criminals adding skimming code to payment pages to capture card and personal data and send it to a domain they control.
How does skimming code get onto a payment page?
+
According to CISA, skimming code is introduced by exploiting a vulnerability in the e-commerce platform, by phishing or brute force of administrator credentials, by hiding code in JavaScript loaded from a third-party service, or by cross-site scripting. The post also stresses having third-party providers' code checked.
What happens to the stolen card data?
+
CISA says the collected card information is either sold or used to make fraudulent purchases. The post reports that the data from these restaurant campaigns was put up for sale on Dark Web platforms.
How can an online business reduce the risk of Magecart?
+
Keep software, hardware and tools up to date, have third-party providers' code checked, and apply a Content-Security-Policy. CISA also lists code integrity checks and regular patching of payment software, and MDN explains that a Content-Security-Policy limits which scripts a page may load.
