As they have been active since 2015, the threat actors in the Magecart gang have had numerous methods of attack and targets to try these methods on. As new research is showing, the Magecart members are now shifting their focus and attack methods once more to evade detection and make a payday by stealing credit card information. The research comes from Willem de Groot, a Dutch national who is considered an expert on Magecart’s activities since their inception.
According to de Groot, the Magecart cybergang is attacking third-party sources affiliated with e-commerce platform Magento that contain a PHP-based zero-day. The zero-day in question is described as follows in a blog post by Willem:
That last sentence pretty much sums up why Magecart is targeting the third parties affiliated with Magento. The ability to skim credit card data is made simple as the extensions are not patched, giving hackers free reign to access data of customers. The way Magecart is going about exploiting the vulnerability is, according to de Groot, "now probing Magento stores in the wild" for the specific extensions listed below:
POST /index.php/madecache/varnish/esi/ POST /index.php/freegift/cart/gurlgift/ POST /index.php/qquoteadv/download/downloadCustomOption/ POST /index.php/ajaxproducts/index/index/ POST /index.php/minifilterproducts/index/ajax/ POST /index.php/advancedreports/chart/tunnel/ POST /index.php/bssreorderproduct/list/add/ POST /index.php/rewards/notifications/unsubscribe/ POST /index.php/emaildirect/abandoned/restore/ POST /index.php/vendors/withdraw/review/ POST /index.php/vendors/credit_withdraw/review/ POST /index.php/gwishlist/Gwishlist/updategwishlist/ POST /index.php/rewards/customer/notifications/unsubscribe/ POST /index.php/aheadmetrics/auth/index/ POST /index.php/customgrid/index/index/ POST /index.php/customgrid/Blcg/Column/Renderer/index/index/ POST /index.php/tabshome/index/ajax/ POST /index.php/customgrid/Blcg_Column_Renderer_index/index/ POST /index.php/rewards/customer_notifications/unsubscribe/ POST /index.php/vendors/credit/withdraw/review/ POST /index.php/multidealpro/index/edit/ POST /index.php/layaway/view/add/ POST /index.php/simplebundle/Cart/add/ POST /index.php/CustomGrid/index/index/ POST /index.php/netgocust/Gwishlist/updategwishlist/ POST /index.php/prescription/Prescription/amendQuoteItemQty/ POST /index.php/ajax/Showroom/submit/
Until these extensions are patched, it simply would be wise for users of the e-commerce website Magento and its third-party affiliations to exercise extreme caution and look for any signs of credit card fraud.
Featured image: Flickr/ CafeCredit.com