Credit card stealing threat actors have come up with a new trend to steal customer payment details from e-commerce WordPress sites.
The threat actors inject credit card skimmers into WordPress plugin files, avoiding the closely-monitored ‘wp-admin’ and ‘wp-includes’ core directories where most injections are short-lived.
According to a new report by Sucuri, the hackers perform credit card theft by first hacking into WordPress sites and injecting a backdoor into the website for persistence.
These backdoors let the hackers to retain access to the site, even if the administrator installs the latest security updates for WordPress and installed plugins.
When the attackers use the backdoor in the future, it will scan for a list of administrator users and use their authorization cookie and current user login to access the site.
The attackers then add their malicious code to random plugins, and many of the scripts are not even obfuscated.
While examining the code, the analysts noticed that an image optimization plugin contained references to WooCommerce and included undefined variables. This plugin has no vulnerabilities and is believed to have been selected by the threat actors at random.
It was found that one of these undefined variables references a domain hosted on an Alibaba server in Germany. This domain had no link to the compromised website they were looking into, which is conducting business in North America.
The same site had a second injection on the 404-page plugin, which held the actual credit card skimmer using the same approach of hidden variables in unobfuscated code.
In order to protect against card skimmers, the site admins can follow several protective measures to keep their sites skimmer-free or minimize the infection times as much as possible.
First, the wp-admin area should be restricted to only specific IP addresses. So, even if a backdoor is injected, the actors could not access the site even if they stole administrator cookies.
Secondly, file integrity monitoring through active server-side scanners should be implemented on the website, ensuring that no code changes will go unnoticed for long.
Lastly, make a habit of reading logs and looking deeply into the details such as file changes, themes, or plugin updates that are always reflected in logs.
Comments