Executive Guardian
Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
Magecart is a rapidly growing cybercrime syndicate comprised of dozens of subgroups that specialize in cyberattacks involving digital credit card theft by skimming online payment forms. Magecart also refers to the JavaScript code those groups inject.
Take a Look Inside Magecart
Magecart works by operatives gaining access to websites either directly or via third-party services and injecting malicious JavaScript that steals data shoppers enter into online payment forms, typically on checkout pages.
Magecart operatives either breach sites directly or via supply chain attacks. Supply chain attacks target third-parties that supply code to websites. Suppliers can include vendors that integrate with sites to add or improve site functionality or cloud resources from which websites pull code, such as Amazon S3 Buckets. These third-parties integrate with thousands of websites, so when one supplier is compromised, Magecart has effectively breached thousands of sites at once.
Learn About Malicious Inject Types
Magecart mainly targets e-commerce websites, aiming to inject their JavaScript skimmers on checkout pages. However, Magecart breaches many different types of sites because they can steal other types of sensitive, monetizable data entered into any online web forms.
Magecart takes advantage of online businesses’ general lack visibility into their web-facing attack surfaces. In many cases, the victims have no idea the JavaScript on their site has been changed, allowing the malicious code to exist there indefinitely. In the case of supply-chain attacks, it’s common a victim does not know that the compromised third-party JavaScript on their site is dangerous — or that they’re even running code from the breached supplier.
The attack compromised the British Airways site directly, taking advantage of its unique structure and functionality. Magecart operatives copied and modified JavaScript supporting payment forms on the British Airways website so that it sent all payment information to an attacker-controlled server. However, they made sure these forms still worked as intended in a user’s browser to avoid detection.
The attackers were also aware that the British Airways mobile app used much of the same functionality as the web app and that breaching the website would also grant them access to the app. Many of these 380,000 victims were mobile app users.
RiskIQ research revealed how some Magecart actors targeting e-commerce sites cash-out by reshipping items purchased with stolen cards via a physical reshipping company operating with mules in the U.S.
By pivoting on a domain related to known Magecart activity in RiskIQ PassiveTotal, RiskIQ found that the server behind its IP address linked to a reshipping company website falsely advertised as a freight/logistics provider. Magecart operatives recruit these mules false employment ads on Russian job websites for U.S.-based job seekers under the pretense of “transport agents.” These mules receive shipments of electronics and other goods bought with stolen credit cards to ship to an address in Eastern Europe.
This technique is similar to more traditional schemes involving money mules, but rather than a direct transfer of funds, the actors behind Magecart transfer funds into higher-priced goods. These goods can be shipped across borders without suspicion, then sold for a hefty profit.
RiskIQ has reported extensively on Magecart and will continue to report on the threat as it evolves. You can see your full Magecart library here.
