Cyber criminals have created a new type of web malware that disappears into images used for social media buttons, with the aim of stealing credit card information that is included in online store payment forms.
The malware — known as web skimmer, or Magecart script — was monitored in online stores between June and September. The Dutch information security company Sanguine Security was the first to monitor it.
The discovery of this particular form of malware indicates that Magecart gangs are constantly developing their malicious tricks, although they have not been widely disseminated.
At the technical level, the malware discovered uses a technique known as concealment of information. This technique refers to hiding information in another format, for example: hiding the text inside the images.
In the world of malware attacks, the concealment of information is usually used as a way to hide malicious code from antivirus software by placing malicious code in files that look like virus-free files.
Over the past years, the most common form of information-hiding attacks has been to hide harmful loads inside image files, which are usually stored in PNG or JPG formats.
In the world of malware called Magecart scripts, hiding information works because most of that software is usually hidden in javaScript code, not in image files.
However, this technique has slowly seen some use among Magecart scripts software bands, after previous information hide attacks used site logos, product images, or preferred symbols to hide loads of malware.
For those who want to protect themselves from this type of malware, users have very few options, as this type of code is usually invisible to them and very difficult to detect, even for professionals.
It is believed that the simplest way shoppers can protect themselves from magecart scripts attacks is to use virtual cards designed to pay once.
Some banks or payment applications currently provide these cards, which is the best way to deal with this malware on the Internet, since even if attackers are able to record transaction details, credit card data is useless because it is created for one-time use.
0 Comments