Security researchers have discovered a novel digital skimming campaign that hides malicious code in 404 error pages to avoid detection.
According to Akamai security researcher, Roman Lvovsky, the attacks have been targeting Magento and WooCommerce websites, including some belonging to large organizations in the food and retail sectors.
Magecart attacks typically work by exploiting vulnerabilities in targeted websites, or third-party services that the websites are using, in order to deploy skimming malware onto payment pages.
As usual, the attacks are split into three distinct phases to make them harder to detect: loader, malicious attack code and data exfiltration.
The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion.
The skimmer loader either disguises itself as a Meta Pixel code snippet or hides within random inline scripts already present on the compromised checkout web page.
The loader initiates a fetch request to a relative path named ‘icons,’ but as this path does not exist on the website, the request results in a “404 Not Found” error.
The researchers initially assumed the skimmer was no longer active or the Magecart group had made a configuration mistake. However, upon closer inspection, they found that the loader contained a regular expression match searching for a specific string in the returned HTML of the 404 page.
Upon locating the string on the page, Akamai found a concatenated base64-encoded string concealed in a comment. Decoding that string revealed the JavaScript skimmer, which hides in all 404 pages.
The researchers simulated additional requests to nonexistent paths, and all of them returned the same 404 error page containing the comment with the encoded malicious code.
These checks confirm that the attacker successfully altered the default error page for the entire website and concealed the malicious code within it!
The skimmer code displays a fake form that the website visitors are expected to fill out with sensitive details, including their credit card number, expiration date, and security code.
In the background, all information is base64-encoded and sent to the attacker via an image request URL carrying the string as a query parameter.
Comments