Web Skimming

An attack, also called formjacking or a magecart attack, in which an attacker injects malicious code into a website and extracts the data a user enters into an HTML form, most often payment card details, submitting that stolen data to a server the attacker controls. A 2016 report suggested as many as six thousand e-commerce sites may have been compromised by this class of attack; in 2018, British Airways had three hundred eighty thousand card details stolen through it, and a similar attack against Ticketmaster the same year affected forty thousand customers through maliciously injected code on payment pages. Magecart, the best known family of software used to carry out these attacks, has been deployed by multiple hacking groups both in targeted intrusions, such as one against the retailer Newegg, and through compromises of shared tools like the Shopper Approved e-commerce toolkit, used on hundreds of sites, and the conspiracy site InfoWars. To avoid detection, Magecart software has been found checking for software renderers associated with virtual machines before activating, on the theory that a virtual machine indicates security research rather than a real purchase, and in one October 2023 case a Magecart variant was found hidden inside a compromised site's own 404 error pages, capturing card data entered into an order form before displaying a fake session timeout message to the victim.