[BreachExchange] Hackers Target Real Estate Websites with Skimmer in Latest Supply Chain Attack

[Terrell Byrd]

https://thehackernews.com/2022/01/hackers-target-real-estate-websites.html

Threat actors leveraged a cloud video hosting service to carry out a supply
chain attack on more than 100 real estate websites operated by Sotheby's
Realty that involved injecting malicious skimmers to steal sensitive
personal information.

"The attacker injected the skimmer JavaScript codes into video, so whenever
others import the video, their websites get embedded with skimmer codes as
well," Palo Alto Networks' Unit 42 researchers said in a report published
this week.

Automatic GitHub Backups
The skimmer attacks, also called formjacking, relates to a type of cyber
attack wherein bad actors insert malicious JavaScript code into the target
website, most often to checkout or payment pages on shopping and e-commerce
portals, to harvest valuable information such as credit card details
entered by users.

Supply Chain Attack
In the latest incarnation of the Magecart attacks, the operators behind the
campaign breached the Brightcove account of Sotheby's and deployed
malicious code into the player of the cloud video platform by tampering
with a script that can be uploaded to add JavaScript customizations to the
video player.

"The attacker altered the static script at its hosted location by attaching
skimmer code. Upon the next player update, the video platform re-ingested
the compromised file and served it along with the impacted player," the
researchers said, adding it worked with the video service and the real
estate company to help remove the malware.

Supply Chain Attack
The campaign is said to have begun as early as January 2021, according to
MalwareBytes, with the harvested information — names, emails, phone
numbers, credit card data — exfiltrated to a remote server
"cdn-imgcloud[.]com" that also functioned as a collection domain for a
Magecart attack targeting Amazon CloudFront CDN in June 2019.

Prevent Data Breaches
To detect and prevent injection of malicious code into online sites, it's
recommended to conduct web content integrity checks on a periodic basis,
not to mention safeguard accounts from takeover attempts and watch out for
potential social engineering schemes.

"The skimmer itself is highly polymorphic, elusive and continuously
evolving," the researchers said. "When combined with cloud distribution
platforms, the impact of a skimmer of this type could be very large."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20220105/4f197cc7/attachment.html>