Once again, the Magecart gang has made it to the news owing to a unique attack strategy. As observed in the recent campaigns, Magecart now hides malicious PHP web shells behind website favicons to maintain persistent access.
Magecart Hiding Web Shells In Favicons
Researchers from Malwarebytes Labs have shared details about the latest Magecart attack strategy in their recent post.
Specifically, they observed Magecart web skimmers hiding the malicious PHP web shells in favicons.
For this, the attackers tend to replace the legit icons with malicious PNG files. However, the files bear a malicious PHP web shell instead of JavaScript, which doesn’t load properly in this form.
Yet, this strategy lets the attackers gain persistent access to the target websites whilst evading detection.
Describing this technique, the researchers stated,
These web shells known as Smilodon or Megalodon are used to dynamically load JavaScript skimming code via server-side requests into online stores. This technique is interesting as most client-side security tools will not be able to detect or block the skimmer.
Magecart Group 12 Behind The Recent Campaign
The researchers noticed the new Magecart attack strategy exploiting favicons while scanning websites. They deduced that the campaign is active in the wild that links back to the Magecart Group 12. It is the same group that targeted numerous Magento 1.x websites in the previous year.
Currently, preventing this type of attack is difficult from the website admins’ perspective. Yet, vigilant monitoring may help in detecting a malicious code right when it loads.
The skimmer we showed… dynamically injects code into the merchant site. The request to the malicious domain hosting the skimming code is not made client-side but server-side instead. As such a database blocking approach would not work here unless all compromised stores were blacklisted, which is a catch-22 situation. A more effective, but also more complex and prone to false positives approach, is to inspect the DOM in real-time and detect when malicious code has been loaded.
However, users can avoid losing their payment details to the attackers. The researchers advise users to use security software and tools that offer protection against malicious websites.