by Chaoying Liu and Joseph C. Chen
On January 1, we detected a significant increase in activity from one of the web skimmer groups we’ve been tracking. During this time, we found their malicious skimming code (detected by Trend Micro as JS_OBFUS.C.) loaded on 277 e-commerce websites providing ticketing, touring, and flight booking services as well as self-hosted shopping cart websites from prominent cosmetic, healthcare, and apparel brands. Trend Micro’s machine learning and behavioral detection technologies proactively blocked the malicious code at the time of discovery (detected as Downloader.JS.TRX.XXJSE9EFF010).
Figure 2: Timeline of web-skimming activities that accessed malicious domains (top); and country distribution of where they were accessed, from January 1 to January 6 (bottom)
Note: Data from Trend Micro™ Smart Protection Network™
Given the attack’s modus of targeting third-party services, we construed them to be from Magecart Group 5, which RiskIQ reported to be linked to several data breach incidents like the one against Ticketmaster last year. With additional help from security researcher Yonathan Klijnsma at RiskIQ, we determined that these web-skimming activities were carried out by Magecart Group 12, a seemingly new subgroup of Magecart.
Magecart Group 12’s Attack Chain
Magecart Group 12 uses a skimming toolkit that employs two obfuscated scripts. The first script is mostly for anti-reversing while the second script is the main data-skimming code. They also include code integrity checking that detects if the script is modified. The check is done by calculating a hash value to the script section, and stops the execution of the script if it finds that it doesn’t match the original hash.
The script also constantly cleans the browser debugger console messages to deter detection and analysis. Part of its fingerprinting routine includes checking if the script is running on a mobile device (by checking the browser User-Agent) and if there are handlers that check if the browser debugger is on. The fingerprinting routines are done to confirm that the browser session is from an actual consumer.
Skimming Payment Data
The second script, the main skimming code, first checks if they are executed on a shopping cart website by detecting related strings in the URL like “checkout,” “billing,” and “purchase,” among others. Also of note are the strings “panier,” which means “basket” in French, and “kasse,” or “checkout” in German. Figure 2 shows that most of our detections (accessing Magecart Group 12-controlled domains) were in France, with a noticeable activity in Germany.
These attacks further demonstrate the importance of securing the infrastructures used to run websites, applications, or web applications, especially those that store and manage sensitive data. Regularly patch and update software; disable, restrict, or secure outdated components or third-party plugins; and strengthen credentials or authentication mechanisms. IT and security teams should also proactively monitor their websites or applications for signs of malicious activities such as unauthorized access and modification, data exfiltration, and execution of unknown scripts.
RiskIQ’s analysis further sheds light on the correlation of Group 12’s activities to Magecart.
The following Trend Micro solutions, powered by XGen™ security, protect users and businesses by blocking the scripts and preventing access to the malicious domains:
- Trend Micro™ Security
- Smart Protection Suites and Worry-Free™ Business Security
- Trend Micro Network Defense
- Hybrid Cloud Security
Indicators of Compromise (IoCs):
Skimming script (SHA-256):
Related malicious domains:
With additional insights and analysis from Yonathan Klijnsma of RiskIQ