Magento Core Malware Steals Payment Card Details

Share It On:

Cybercriminals are targeting websites running the Magento platform to inject them with code that can steal credit card data and infect visitors with malware, Flashpoint reports.

A new payment card stealing campaign with skimmer script targeting Magento stores is embedding Javascript based Magento core Malware on Magento stores that record keystrokes from customers and transfer the data in real-time to Magento core command and control servers.

This week, on Monday, Willem de Groot, a well-known Dutch security expert, figured out a previously unreported card scrapping campaign involving a skimmer script loaded from the magentocore.net domain.

At least 1,000 Magento admin panels have been compromised, Flashpoint says. The attackers attempt to log in using standard and known default Magento credentials, once again proving that changing the credentials upon installation of the platform can prevent compromise.

The campaign has infected 7,339 Magento stores with a script that collects payment card data from people shopping on the sites.

“The rash of attacks resurrects the epidemic of default credential usage among admins. Default credentials were at the core of the 2016 Mirai attacks where hackers were able to access connected devices such as security cameras, DVRs and routers using known and common default passwords,” Flashpoint notes.

GB Hackers has described the working mechanism of Magento core Malware:

The malware gain access to the control panel of the store by using brute force techniques and once they gain access to the store they embedded a skimmer Javascript and the scripts look for inputs in fields such as credit card number, validity and billing address.

Once it gathers the required information, it sends the data in real-time to magentocore[.]Net server that located in Moscow.

The malware also adds a backdoor to the cron file which used to configure regularly scheduled tasks. By having a backdoor added in the cron file, it regularly downloads the malicious code from the server and runs the code. After running the code, it also deletes itself to avoid traces.

It also removes any other competing malware found already installed in the Magento Store. Also, it uses to change the password “how1are2you3″ periodically to the admin accounts.


Share It On:

Recent Posts

Complaints For Overcharged International Flight Tickets in Nepal – Ministry Takes Action

Complaints For Overcharged International Flight Tickets in Nepal – Ministry

Share It On: 25th November 2024, Kathmandu The Ministry of Culture, Tourism, and Civil Aviation has launched a new initiative

VinFast Delivers VF 5 Electric Cars in Indonesia | Gaikindo Jakarta Auto Week 2024

VinFast Delivers VF 5 Electric Cars in Indonesia | Gaikindo

Share It On:25th November 2024, Kathmandu VinFast Auto has officially launched the delivery of its electric VF 5, at the

Assure Medical Imaging: Grand Opening in Tsim Sha Tsui Redefines Medical Diagnostics

Assure Medical Imaging: Grand Opening in Tsim Sha Tsui Redefines

Share It On:25th November 2024, Kathmandu Assure Medical Limited (“Assure Medical” or the “Company”) is delighted to announce the Grand

Trend Micro: Leading AI-Powered Cloud Security for Healthcare and Regulated Industries

Trend Micro: Leading AI-Powered Cloud Security for Healthcare and Regulated

Share It On:25th November 2024, Kathmandu Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, continues to lead

How 5G Transforms Life: A Foreigner’s Journey Through East China’s Digital Revolution

How 5G Transforms Life: A Foreigner’s Journey Through East China’s

Share It On:25th November 2024, Kathmandu As the 2024 World Internet Conference Summit opened in Wuzhen, Zhejiang province on November

Nepal AI School 2024: Shaping the Future of AI in the Global South

Nepal AI School 2024: Shaping the Future of AI in

Share It On:25th November 2024, Kathmandu The NepAI Applied Mathematics and Informatics Institute for Research (NAAMII) is thrilled to announce