Web skimming, formjacking or a magecart attack is an attack in which the attacker injects malicious code into a website and extracts data from an HTML form that the user has filled in. That data is then submitted to a server under control of the attacker.

Mitigation

Subresource Integrity or a Content Security Policy can be used to protect against formjacking, although this does not protect against supply chain attacks. A web application firewall can also be used.

Prevalence

A report in 2016 suggested as many as 6,000 e-commerce sites may have been compromised via this class of attack. In 2018,

British Airways British Airways plc (BA) is the flag carrier of the United Kingdom. It is headquartered in London, England, near its main Airline hub, hub at Heathrow Airport. The airline is the second largest UK-based carrier, based on fleet size and pass ...

had 380,000 card details stolen via this class of attack. A similar attack affected

Ticketmaster Ticketmaster Entertainment, LLC is an American ticket sales and distribution company based in Beverly Hills, California, with operations in many countries around the world. In 2010, it merged with Live Nation under the name Live Nation Ente ...

the same year, with 40,000 customers affected by maliciously injected code on payment pages.

Magecart

Magecart is software used by a range of hacking groups for injecting malicious code into ecommerce sites to steal payment details. As well as targeted attacks such as on Newegg, it's been used in combination with commodity Magento extension attacks. The 'Shopper Approved' ecommerce toolkit utilised on hundreds of ecommerce sites was also compromised by Magecart as was the conspiracy site InfoWars. According to Malwarebytes, the Magecart software has tried to avoid detection by using the

WebGL WebGL (short for Web Graphics Library) is a JavaScript Application programming interface, API for rendering interactive 2D and 3D graphics within any compatible web browser without the use of plug-in (computing), plug-ins. WebGL is fully integra ...

API to check whether a software renderer such as " swiftshader", " llvmpipe" or "

virtualbox Oracle VirtualBox (formerly Sun VirtualBox, Sun xVM VirtualBox and InnoTek VirtualBox) is a hosted hypervisor for x86 virtualization developed by Oracle Corporation. VirtualBox was originally created by InnoTek Systemberatung GmbH, which was ac ...

" is used. That would indicate that the software is running in a

virtual machine In computing, a virtual machine (VM) is the virtualization or emulator, emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve ...

probably used to detect the malware rather than make a purchase. In October 2023 a Magecraft version was reported to be inserted into all the 404 error pages of infected Web sites. The default "

404 Not Found In Data communication, computer network communications, the HTTP 404, 404 not found, 404, 404 error, page not found, or file not found error message is a hypertext transfer protocol (HTTP) List of HTTP status codes, standard response code, to ...

" page is used to hide and load the card-stealing code. The site visitor enters sensitive details into, for example, an order form, then sees a fake "session timeout" error, while the information is sent to the attacker.

References

{{malware-stub Hacking (computer security) Web security exploits Internet fraud Carding (fraud) Types of cyberattacks