Hackers Target Real Estate Websites With Skimmer In Latest Supply Chain Attack

Threat actors leveraged a cloud-based video hosting service to carry out a supply chain attack on more than 100 real estate websites operated by Sotheby’s Realty that involved the injection of malicious skimmers to steal assets. sensitive personal information.

“The attacker injected the skimmer’s JavaScript codes into the video, so whenever others upload the video, their websites are also embedded with skimmer codes,” Palo Unit 42 researchers said. Alto Networks in a report released this week.

GitHub automatic backups

Skimmer attacks, also known as formjacking, are related to a type of cyber attack in which malicious actors insert malicious JavaScript code into the target website, most commonly on checkout or checkout pages on shopping portals and e-commerce, to collect valuable information such as credit card. details entered by users.

Supply chain attack

In the latest incarnation of the Magecart attacks, the operators behind the campaign hacked Sotheby’s Brightcove account and deployed malicious code in the cloud video platform player by forging a script that can be downloaded to add JavaScript customizations to the video player.

“The attacker modified the static script at its hosted location by attaching the skimmer code. On the next player update, the video platform reinstated the compromised file and served it with the affected player.” the researchers said, adding that it worked with the video service and the real estate company to help remove the malware.

Supply chain attack

The campaign would have started as early as January 2021, according to MalwareBytes, with the information gathered – names, emails, phone numbers, credit card data – exfiltrated to a remote server “cdn-imgcloud[.]com “which also functioned as a collection domain for a Magecart attack targeting Amazon CloudFront CDN in June 2019.

Prevent data breaches

To detect and prevent the injection of malicious code into online sites, it is recommended to perform periodic web content integrity checks, remembering to protect accounts from takeover attempts and to be careful to potential social engineering schemes.

“The skimmer itself is highly polymorphic, elusive and ever-changing,” the researchers said. “When combined with cloud distribution platforms, the impact of such a skimmer could be very significant.”

Comments are closed.