Recently, researchers found the MageCart attack on a donation site set up for the Australia bushfire donation. While the site is legit, the donors unwittingly fell prey to credit card skimming.
MageCart On Australia Bushfire Donation Site
Researchers from the Malwarebytes Labs have found an Australia Bushfire donation website under the MageCart attack. This incident exposed donor credit card details to the attackers behind the skimmer.
According to BleepingComputer, the researchers found a legitimate donation collection website for the Australia bushfire under a credit-card skimming attack. They noticed a malicious skimmer ‘ATMZOW’ script running on the checkout page of the website.
#Magecart skimmer stealing from folks donating to Australia's bushfire effort.
Skimmer is 'ATMZOW', exfiltration domain vamberlo[.]com was already known. pic.twitter.com/1qwPqSPEQm
— Malwarebytes Threat Intelligence (@MBThreatIntel) January 10, 2020
Digging further into the code it was revealed that the script pilfered donor’s payment information from the checkout page. It then submitted the data to a domain vamberlo.com obfuscated in the script.
According to Troy Mursch, the same script affected 39 other websites as well. However, it isn’t clear whether the script utilized the same domain as that of the bushfire donation site.
39 other sites are also compromised, per @publicww results: https://t.co/Xb0DWjLa59 pic.twitter.com/G5uoOmk1UF
— Bad Packets (@bad_packets) January 10, 2020
Malicious Domain Now Down
Upon noticing the domain containing the malicious script, researchers managed to get the domain vamberlo.com shut down.
All other websites (if the MageCart code running on them utilized vamberlo.com as domain), as well as the Australia bushfire donation site, are now seemingly safe.
However, the malicious script is still running on the infected websites, at least on the bushfire donation site. Therefore, it is possible the attackers may modify the script at any time to run the skimmer again.
Credit card skimming attacks have been infecting various businesses and websites for quite a long time. And now, with the latest infection on a donation website, it is clear that the MageCart attackers don’t really care where they make a buck.
Let us know your thoughts in the comments.
