Once again, the Magecart gang has made it to the news owing to a unique attack strategy. As observed in the recent campaigns, Magecart now hides malicious PHP web shells behind website favicons to maintain persistent access.
Magecart Hiding Web Shells In Favicons
Researchers from Malwarebytes Labs have shared details about the latest Magecart attack strategy in their recent post.
Specifically, they observed Magecart web skimmers hiding the malicious PHP web shells in favicons.
Yet, this strategy lets the attackers gain persistent access to the target websites whilst evading detection.
Describing this technique, the researchers stated,
Magecart Group 12 Behind The Recent Campaign
The researchers noticed the new Magecart attack strategy exploiting favicons while scanning websites. They deduced that the campaign is active in the wild that links back to the Magecart Group 12. It is the same group that targeted numerous Magento 1.x websites in the previous year.
Currently, preventing this type of attack is difficult from the website admins’ perspective. Yet, vigilant monitoring may help in detecting a malicious code right when it loads.
The skimmer we showed… dynamically injects code into the merchant site. The request to the malicious domain hosting the skimming code is not made client-side but server-side instead. As such a database blocking approach would not work here unless all compromised stores were blacklisted, which is a catch-22 situation. A more effective, but also more complex and prone to false positives approach, is to inspect the DOM in real-time and detect when malicious code has been loaded.
However, users can avoid losing their payment details to the attackers. The researchers advise users to use security software and tools that offer protection against malicious websites.