Magecart Campaigns: E-Skimmers Target Restaurants, Stealing Payment Card Records

This article provides an overview of the Magecart campaigns that have targeted over 300 restaurants, resulting in the theft of more than 50,000 payment card records. The campaigns primarily focused on three online ordering platforms, with the majority of affected restaurants being small establishments in the United States. The MenuDrive and Harbortouch platforms were compromised by Magecart malware, which was designed to collect credit card data during the checkout process. The Harbortouch campaign utilized a single script to steal user information and payment card data, while the InTouchPOS campaign employed skimmer injections. The stolen card details are being sold on dark-web marketplaces for illicit purposes. Security firm Recorded Futures detected these campaigns and promptly notified the impacted entities, payment platforms, and law enforcement agencies. In addition, the firm provided insights on how to defend against similar attacks. This information aims to raise awareness among fraud and CTI teams in financial institutions, as well as security professionals in the e-commerce sector.

Key Takeaways

• Two web-skimming campaigns targeted three online ordering platforms, affecting over 310 restaurants and resulting in the theft of 50,000 payment card records.
• The majority of the affected restaurants are small establishments in the United States.
• The Magecart malware was injected into the websites of the MenuDrive and Harbortouch platforms, collecting credit card data on checkout pages.
• Stolen payment cards from over 300 restaurants are being sold on dark-web marketplaces, facilitating illegal transactions.

Magecart Overview

The Magecart campaigns, which targeted online ordering platforms and resulted in the theft of over 50,000 payment card records from more than 300 restaurants, highlight the increasing prevalence of e-skimmers as a method of stealing sensitive financial information. These campaigns exploit e-commerce vulnerabilities to inject skimmer malware into the websites of affected platforms, enabling the collection of credit card data during the checkout process. The stolen payment cards are then sold on dark web marketplaces, facilitating illegal transactions. This demonstrates the evolving tactics employed by cybercriminals to exploit weaknesses in online payment systems and underscores the need for robust security measures to protect against such attacks. The Magecart campaigns serve as a stark reminder of the importance of continuous monitoring and proactive defense strategies to safeguard the integrity of e-commerce platforms and prevent the unauthorized access and misuse of customer payment information.

Affected Platforms

Affected online ordering platforms were targeted by web-skimming campaigns, resulting in the compromise of over 310 restaurants and the theft of 50,000 payment card records. The Magecart campaigns had a significant impact on small businesses, as the majority of affected restaurants were small establishments in the United States. The compromised platforms, MenuDrive and Harbortouch, were injected with Magecart malware, which collected credit card data on checkout pages. The stolen payment cards are being sold on dark web marketplaces, facilitating illegal transactions. The number of marketplaces involved in the sale of the stolen card details is not specified. This breach highlights the need for robust security measures in the e-commerce sector, particularly for small businesses that may lack the resources to effectively defend against such attacks.

Skimmer Operation

Skimmer operations involve the deployment of stealthy code that surreptitiously collects sensitive customer information during online transactions, resembling a legitimate process while discreetly exfiltrating the data to illicit domains. In the case of the Magecart campaigns targeting restaurants, skimmers used JavaScript code to carry out their operations. These skimmers employed various techniques and evasion tactics to avoid detection, such as disguising themselves as legitimate targets and utilizing fake payment forms. By doing so, they aimed to steal cardholder information without raising suspicion. The stolen payment card records were then sold on dark web marketplaces, which form part of the illegal transactions facilitated through the dark web marketplace ecosystem. This highlights the need for robust security measures to defend against such skimmer operations and protect customer data from falling into the wrong hands.

Response and Impact

Security measures were notified and stakeholders were informed to address the compromise in the Magecart campaigns, aiming to mitigate the impact and prevent further illegal transactions. The compromised entities, including the affected payment platforms and law enforcement agencies, were promptly notified by the security firm. However, no response has been received from the impacted entities thus far. In addition to informing the affected parties, the security firm also followed the necessary requirements to address the situation. This likely involved implementing communication strategies to ensure that all relevant parties were aware of the breach and its implications. It is important to note that the legal implications of these Magecart campaigns, such as the theft of payment card records and the subsequent selling of these stolen cards on dark-web marketplaces, could have significant consequences. Efforts to identify and apprehend the hackers responsible for these campaigns are crucial in combating such cybercrimes and safeguarding the affected individuals and organizations.

Threat Detection

Threat detection tools and techniques were employed to identify the malicious activity associated with the unauthorized acquisition of sensitive financial information during the Magecart campaigns. The use of threat intelligence played a crucial role in this process, allowing security professionals to gain insights into the tactics, techniques, and procedures used by the attackers. By leveraging threat intelligence services, such as those provided by Recorded Futures, organizations were able to understand the scope and impact of the Magecart campaigns. These tools helped in identifying the skimmer injections, tracking the exfiltration domains, and monitoring the illegal transactions facilitated through dark web marketplaces. The dark web, where stolen payment card details were being sold, was a key area of focus for threat detection, as it provided valuable information on the sale and distribution of compromised data.

Frequently Asked Questions

How are the stolen payment card records being used or sold on dark-web marketplaces?

The stolen payment card records are being sold on dark-web marketplaces, where buyers can purchase the details of the stolen cards. This illegal activity negatively impacts consumer trust and highlights the need for effective countermeasures against e-skimmers.

What actions can the compromised entities take to address the situation and mitigate the impact?

To address the situation and mitigate the impact, the compromised entities can take several actions. They should promptly respond to the security firm’s notification, conduct a thorough scan of all restaurant subdomains, remove the skimmers, and enhance their website security measures to prevent future attacks.

Are there any specific details about the techniques or tools used by Recorded Futures to detect the Magecart campaigns?

Recorded Futures utilized various threat detection tools and techniques to identify the Magecart campaigns. Although specific details regarding the tools used were not provided, their identification showcases the effectiveness of their threat intelligence services in understanding the scope and impact of the campaigns.

Are there any updates on the ongoing exfiltration domains and campaigns related to the Harbortouch and InTouchPOS platforms?

There are no specific updates on the ongoing exfiltration domains and campaigns related to the Harbortouch and InTouchPOS platforms in regards to the theft of payment card records.

Can the presentation on Magecart campaigns provide insights on defending against similar attacks for financial institutions and the e-commerce sector?

The presentation on Magecart campaigns can provide valuable insights on defending against similar attacks for financial institutions and the e-commerce sector. It may cover topics like defending against e-commerce attacks and implementing security measures for financial institutions.