Did your company or e-commerce firm recently buy third-party software from a value-added reseller (VAR) or systems integrator? Did you vet the vendor code? If not, you could be at risk for a Magecart group attack.
Magecart is an association of threat actor groups who target online shopping carts, mostly from within the e-commerce platform Magento. The Magecart name is derived by combining ‘Mage’ (from Magento) with ‘cart’ (shopping cart). This type of attack is especially dangerous as it only takes one line of code to steal payment card data.
Magecart attacks can compromise a piece of third-party software from a VAR or systems integrator. Recently, they’ve been infecting a variety of supply chain processes.
Let’s take a closer look at this malicious attack vector and how it has evolved over time. Later, we’ll explore ways you can protect your business and customers from Magecart attacks.
Magecart: Just One Line of Code
Back in 2015, Magecart made global headlines with a series of high-profile attacks targeting some big names in air travel, ticketing and retail.
In the classic Magecart attack, threat actors insert a single line of malicious code, such as a JavaScript sniffer. Once installed, whenever a user lands on the compromised website’s shopping cart or checkout page, the code downloads the JS sniffer. From there, attackers can intercept any information entered onto the page and send the data to the attacker.
This type of credit card number decoder attack is also known as a credit card skimmer, digital skimmer, web skimmer or formjacking.
Magecart can magecart attacks continue software supply chains
