ℹ️ We found a #Magecart skimmer that was new to us via @urlscanio
➡️ Seen ITW and tagged by @sansecio:
https://t.co/3YpMNNxet0
➡️ Exfiltrates data via:
gs27usa[.]com/translations/tw/mails.php
➡️ Raw: https://t.co/9WdJCXi8xf
➡️ Beautified: https://t.co/DAA7UeM3yn
💡 The latest update for #FiddlerEverywhere adds a similar feature known as the 'TextWizard' in Fiddler Classic.
➡️ Select a string and right-click 'Decode Selection'
⚠️ New malicious domain found in use: quickespark[.net
This malware loads only when a user interacts with the infected #ecommerce store, using 'onmousemove' and 'ontouchstart'.
Full URL: hxxps://cdn[.quickespark[.net/static/base[.js
New hostnames related to the 'Anti-sandbox' #Magecart skimmer
js[.]knowledgecdn[.]org
m[.]sale-alerts[.]com
s[.]geotac[.]net
185.253.33[.]176
185.63.190[.]141
89.108.109[.]26
@PaulWebSec@pancak3lullz Depends what exactly you need it for, but EKFiddle can parse the page content in real time and find patterns that you can define as well
Seeing a lot of 'Bom' #Magecart infections right now. Injections in compromised stores are located before the </head> tag.
Article on Bom skimmer: https://t.co/TR3G4nKSoy
IOCs:
apfeltee[.]de
www.usaayurveda[.]com
Another skimmer with HTTP and WSS exfils found in DB of a WordPress site (the malware loaded JS from a fake .png file).
hxxps://appcloudflare[.com/app/
wss://livehotjars[.com/api/v2/client/ws
Re: https://t.co/erwgZqp30e