by Chaoying Liu and Joseph C. Chen
On January 1, we detected a significant increase in activity from one of the web skimmer groups we’ve been tracking. During this time, we found their malicious skimming code (detected by Trend Micro as JS_OBFUS.C.) loaded on 277 e-commerce websites providing ticketing, touring, and flight booking services as well as self-hosted shopping cart websites from prominent cosmetic, healthcare, and apparel brands. Trend Micro’s machine learning and behavioral detection technologies proactively blocked the malicious code at the time of discovery (detected as Downloader.JS.TRX.XXJSE9EFF010).
, a French online advertising company, which we promptly contacted. Adverline has handled the incident and has immediately carried out the necessary remediation operations in relationship with the CERT La Poste.
Figure 1: Attack chain of the online skimming attack
Figure 2: Timeline of web-skimming activities that accessed malicious domains (top); and country distribution of where they were accessed, from January 1 to January 6 (bottom)
Note: Data from Trend Micro™ Smart Protection Network™
Given the attack’s modus of targeting third-party services, we construed them to be from Magecart Group 5, which RiskIQ reported
to be linked to several data breach incidents
like the one against Ticketmaster last year. With additional help from security researcher Yonathan Klijnsma
at RiskIQ, we determined that these web-skimming activities were carried out by Magecart Group 12, a seemingly new subgroup of Magecart
Magecart Group 12’s Attack Chain
Figure 3: The malicious code injected into compromised e-commerce websites by Magecart Group 12
Figure 4: The injected malicious code in Adverline’s retargeting script, designed to load skimming code (highlighted)
Magecart Group 12 uses a skimming toolkit that employs two obfuscated scripts. The first script is mostly for anti-reversing while the second script is the main data-skimming code. They also include code integrity checking that detects if the script is modified. The check is done by calculating a hash value to the script section, and stops the execution of the script if it finds that it doesn’t match the original hash.
Figure 5: Snapshot of code from the script of the toolkit responsible for integrity checking (deobfuscated)
The script also constantly cleans the browser debugger console messages to deter detection and analysis. Part of its fingerprinting routine includes checking if the script is running on a mobile device (by checking the browser User-Agent) and if there are handlers that check if the browser debugger is on. The fingerprinting routines are done to confirm that the browser session is from an actual consumer.
Figure 6: Snapshot of code from one of the scripts in the toolkit responsible for fingerprinting (deobfuscated)
Skimming Payment Data
The second script, the main skimming code, first checks if they are executed on a shopping cart website by detecting related strings in the URL like “checkout,” “billing,” and “purchase,” among others. Also of note are the strings “panier,” which means “basket” in French, and “kasse,” or “checkout” in German. Figure 2 shows that most of our detections (accessing Magecart Group 12-controlled domains) were in France, with a noticeable activity in Germany.
with the key name Cache
. The copied data is Base64-encoded. It also generates a random number to specify individual victims, which it reserves into LocalStorage with key name E-tag
” is triggered whenever the user closes or refreshes the payment webpage. The script then sends the skimmed payment data, the random number (E-tag), and the e-commerce website’s domain to a remote server through HTTP POST, with Base64 coding on the entire sent date.
Figure 7: The main payment data-skimming code used in the attack (deobfuscated)
These attacks further demonstrate the importance of securing
used to run websites, applications, or web applications, especially those that store and manage sensitive data. Regularly patch and update
software; disable, restrict, or secure outdated components or third-party plugins; and strengthen credentials or authentication mechanisms. IT and security teams should also proactively monitor their websites or applications for signs of malicious activities such as unauthorized access and modification, data exfiltration, and execution of unknown scripts.
further sheds light on the correlation of Group 12’s activities to Magecart.
The following Trend Micro solutions, powered by XGen™ security
, protect users and businesses by blocking the scripts and preventing access to the malicious domains:
Indicators of Compromise (IoCs):
Skimming script (SHA-256):
Related malicious domains:
With additional insights and analysis from Yonathan Klijnsma of RiskIQ