Security researchers at Visa have spotted a unique JavaScript payment card-skimmer that tries to evade detection by removing itself from the HTML code of a compromised website after it successfully executes.
In a security alert, Visa's Payment Fraud Disruption (PFD) group described the self-cleaning mechanism as something they have not previously encountered in the wild with JavaScript skimmers, although it is common with desktop malware. "[It] marks a significant development in JavaScript skimming," Visa warned.
Visa's researchers discovered Pipka — as they are calling the malware — on a North American e-commerce site that had been previously infected with Inter, another JavaScript malware for skimming payment-card data from merchant sites. Since that initial discovery, Visa has identified at least 16 other e-commerce sites that Pipka has infected.
Visa's alert did not disclose whether the operators of Pipka had actually managed to steal payment card data from these sites, and if they had, what the scope of the theft might have been. "PFD assesses that Pipka will continue to be used by threat actors to compromise eCommerce merchant websites and harvest payment account data," the alert said.
Sam Cleveland, senior analyst at Visa's PFD team, says Visa presently is unable to provide any information on payment card fraud or theft related to Pipka. "Visa does not have this information to share due to this being an ongoing investigation," Cleveland says.
JavaScript skimmers like Pipka are designed to do what credit-card skimmers do in the physical word, which is to steal card data that can be used to make fraudulent purchases. Often, threat actors have sneaked these skimmers on e-commerce sites via third-party components that thes ..
Support the originator by clicking the read the rest link below.
