EKFiddle

An extension/rules for the Fiddler Classic and Fiddler Everywhere web debuggers | Tweets by @malwareinfosec

[EKFiddle @EKFiddle]

Added 'Mag_cache' skimmer detection to EKFiddle (ref: https://t.co/HTqKKA2I6h)

Rules for Fiddler Classic and Fiddler Everywhere:
https://t.co/U67qZoKyfm

[ThreatDown @Threat_Down]

ℹ️ We found a #Magecart skimmer that was new to us via @urlscanio

➡️ Seen ITW and tagged by @sansecio:
https://t.co/3YpMNNxet0

➡️ Exfiltrates data via:
gs27usa[.]com/translations/tw/mails.php

➡️ Raw: https://t.co/9WdJCXi8xf

➡️ Beautified: https://t.co/DAA7UeM3yn

[EKFiddle @EKFiddle]

ℹ️ Updated FakeUpdates/SocGholish rules for both Fiddler Classic and Fiddler Everywhere

➡️ https://t.co/U67qZoKyfm

[EKFiddle @EKFiddle]

#FakeUpdates
.breatheinnew[.]life
.roles.thepowerofgodswhisper[.]com
77.91.127[.]52

[EKFiddle @EKFiddle]

💡 The latest update for #FiddlerEverywhere adds a similar feature known as the 'TextWizard' in Fiddler Classic.

➡️ Select a string and right-click 'Decode Selection'

[EKFiddle @EKFiddle]

ℹ️ It looks like the SSL certificate for maps .windows .com (Bing maps) expired 2 days ago

[EKFiddle @EKFiddle]

💡 New version of Fiddler Everywhere adds horizontal view mode.

[EKFiddle @EKFiddle]

#EKFiddle rules updates for a couple of #Magecart skimmers (greatz/Magneto)

https://t.co/U67qZosp1e

[EKFiddle @EKFiddle]

New #Magecart domain jsconfigur[.]net

➡️ JavaScript:
jsconfigur[.]net/js/config.js

➡️ Exfiltration:
jsconfigur[.]net/configure/collecting.php

[EKFiddle @EKFiddle]

@CTI_Marc Blog:
https://t.co/POaFnR5sJn

mousemove:
https://t.co/V2hHdGbCVF

[Sansec @sansecio]

⚠️ New malicious domain found in use: quickespark[.net

This malware loads only when a user interacts with the infected #ecommerce store, using 'onmousemove' and 'ontouchstart'.

Full URL: hxxps://cdn[.quickespark[.net/static/base[.js

[EKFiddle @EKFiddle]

New hostnames related to the 'Anti-sandbox' #Magecart skimmer

js[.]knowledgecdn[.]org
m[.]sale-alerts[.]com
s[.]geotac[.]net

185.253.33[.]176
185.63.190[.]141
89.108.109[.]26

[EKFiddle @EKFiddle]

#Magecart exfiltration with image (hash: ad7f76306b7deced1aea2cafb9e0cdfd00716ba713b382a079c7d743a396cf87) links to previous Porkbun infrastructure.

dxloc[.]buzz
dylorean[.]cyou

141.98.82[.]244
5.188.62[.]10

[EKFiddle @EKFiddle]

💡 #EKFiddle tip

➡️ Flag traffic by IP address with exact match or regular expression.

Works for both Fiddler Classic and Fiddler Everywhere

[EKFiddle @EKFiddle]

@PaulWebSec @pancak3lullz Depends what exactly you need it for, but EKFiddle can parse the page content in real time and find patterns that you can define as well

[EKFiddle @EKFiddle]

Late to the game, but #EKFiddle detection for CVE-2022-30190 (Follina) added.

https://t.co/U67qZosp1e

[EKFiddle @EKFiddle]

Seeing a lot of 'Bom' #Magecart infections right now. Injections in compromised stores are located before the </head> tag.

Article on Bom skimmer: https://t.co/TR3G4nKSoy

IOCs:
apfeltee[.]de
www.usaayurveda[.]com

[EKFiddle @EKFiddle]

Fake slideshow #Magecart skimmer (ref: https://t.co/Ufvn3qIxrk)

➡️ Skimmer JS:
code2a[.]com/js/lib/translate.js

➡️ Exfiltration:
bsvholdingsa[.]com

[Eric Brandel @AffableKraut]

This skimmer is really pretty convincing that it's nothing malicious. Looks like it's a slideshow or something.

[EKFiddle @EKFiddle]

New #Magecart domain contactsform[.]com

➡️ Skimmer loaded inside GIF image
➡️ Exfiltration via WebSocket

Related to this https://t.co/Vh5DcEAddq

[Denis @unmaskparasites]

Another skimmer with HTTP and WSS exfils found in DB of a WordPress site (the malware loaded JS from a fake .png file).
hxxps://appcloudflare[.com/app/
wss://livehotjars[.com/api/v2/client/ws
Re: https://t.co/erwgZqp30e

[EKFiddle @EKFiddle]

'Mirasvit' Magecart skimmer. Maybe tied to exploitation of the Mirasvit plugin?

➡️ Exfiltration:
hubberstore[.]com

[EKFiddle @EKFiddle]

'Recaptcha' Magecart skimmer

➡️ JavaScript:
cafeunido[.]com/pub/media/flag/flag.js
candlemaking[.]com/media/email/logo/default/az1.js

➡️ Exfiltration:
cafeunido[.]com/pub/errors/default/403.php
ariaperfume[.]com/errors/default/403.php

[EKFiddle @EKFiddle]

New 'Bom' Magecart skimmer domain (compromised site)

➡️ apfeltee[.]de/js/prototype/form.js

Regexes for Fiddler Classic/Everywhere available at:
https://t.co/U67qZosp1e