- Researchers found more than four dozen e -trading sites infected with a credit card skimmer
- The skimmer abused an outdated stripe API to validate the information
- Users are advised to migrate to the new API
Legacy Stripe APIs are hijacked to process false payments made on compromised e -trading sites, experts have warned.
CyberSecurity scientists JSCRAMBLER have outlined a campaign that has been underway since at least the end of August 2024, with at least 49 E -trading sites compromised with a credit card skimmer.
However, the final number of victims is probably much greater as the study is still underway.
“Sophisticated campaign”
On these 49 sites, however, attackers injected a malicious JavaScript code that overlaid the legitimate checkout page with a fake. The overlooked destination page then harvested people’s payment information, and upon completion they earned them a false error that asked them to reload the page.
The attackers would then use an old stripe API, called “API.strip[.]com/v1/sources ”to process the payments.
JSCRAMBLER says the striker could also “easily do it later” using Carding Bots or Dark Web Services.
However, there are benefits to doing so on the client page, mostly as all sites already used API as part of their normal payment current.
Furthermore, many security tools and researchers often use invalid credit card information as part of their work, so that not foaming in these cases means that being less likely to be discovered.
How these sites were compromised is anyone’s guess, but JSCrambler speculates that attackers are likely to abuse various vulnerabilities and wrong configurations. Woocommerce, WordPress and Prestashop places were all targeted.
“This sophisticated web foam campaign highlights the evolving tactics that attackers use to remain undetected,” the researchers said. “And as a bonus filtering the effectively invalid credit card data, ensuring that only valid credentials are stolen.”
The best way to mitigate this risk is to use the latest stripe API to process the information. Whoever was abused in these attacks has been discharged in favor of Paymentmethod’s API in May 2024.
Via Hacker the news
