Law enforcement found more than 400 online merchants infected with e-skimmers following a coordinated international action.
The two-month campaign by Europol and law enforcement agencies in 17 countries identified infected e-commerce sites and alerted them that their customers’ card data had been compromised.
It identified two dozen new e-skimmers, i.e., malicious software or ‘malware’ types. These include AngryBeaver, ATMZOW, FirstKiss, FakeGA, health_check, Inter and R3nin.
What is E-skimming?
E-skimming, or digital skimming, involves stealing sensitive data users enter into web forms. Often, this is payment data from online checkout pages, but it can also include personally identifiable information (PII) from other web forms.
E-skimming goes by many names, including digital skimming, data skimming, and formjacking. More specific terms include JavaScript attacks or Magecart attacks, which hint at how skimming works.
Criminals exploit vulnerabilities in a website’s code or infrastructure to harvest data. These attacks are hard to detect as the payment process is unaffected. The customer gets their goods or services, and the merchant gets paid. Both parties are unaware that a compromise may have occurred.
LEARN MORE: How to Strengthen E-commerce Security Against E-skimming Threats
How Does E-skimming Work?
In general, there are four stages in an e-skimming attack:
1. Initial breach
Criminals gain access to an online store’s server source code, either through a first-party attack or by compromising a third party. They often do this by exploiting software vulnerabilities, deploying malware, or using stolen (or phished) credentials.
2. Code injection
Criminals inject malicious code to compromise payment pages. They evolve their methods. They tailor their methods depending on whether payment forms appear directly on pages or are embedded using an iframe.
JavaScript attacks, as the name suggests, target the programming language used to create interactive pages on more than 98% of websites.
Magecart attacks are named after ‘Magento’, the primary open-source e-commerce platform, and shopping ‘cart’. Magecart also refers to the criminal group that has been active since 2015, carrying out such attacks.
3. Data exfiltration
Data harvesting occurs when consumers enter payment details to complete purchases on compromised payment pages. The malicious code covertly skims and collects the information, often encrypting it, before sending it to the attacker’s remote server.
4. Monetization
Criminals monetize stolen data by using it to make unauthorized, fraudulent purchases of goods to resell for cash. Or by selling the data to other criminals.
How Did We Get Here?
The Internet was designed for sharing and collaboration, not necessarily banking and shopping. How web applications are built has also changed over time.
Business intelligence has moved from company-owned and managed web servers into the consumer web browser, powered by JavaScript, distributed APIs, and microservices.
As a result, any JavaScript running on a browser can access all data entered into form fields on that page. With no separation between different application parts, this makes payment pages susceptible to client-side attacks, such as skimming.
What’s the Solution?
Don’t underestimate the importance and effectiveness of business-as-usual security. E-commerce businesses can take several steps to protect themselves from e-skimming attacks and prevent unauthorized access to sensitive data.
These range from regular security assessments, monitoring, and third-party due diligence to secure coding and adherence to payment security standards (PCI DSS).
The latter is becoming increasingly important, as PCI DSS v4.0 includes two new requirements to protect against and detect these e-skimming attacks on payment pages. These will be requirements from 01 April 2025.
The first requirement (6.4.3) is designed to minimize the attack surface and manage all JavaScript present on the payment page. The second requirement (11.6.1) aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.
Jscrambler Client-Side Protection Platform
The Jscrambler Client-Side Protection Platform safeguards first-party JavaScript through state-of-the-art obfuscation and exclusive runtime protection.
Its fine-grained JavaScript behavioral analysis also mitigates threats and risks from third-party tags while ensuring compliance with the new PCI DSS v4.0 standard. With Jscrambler, businesses adopt a unified, future-proof client-side security policy while achieving compliance with emerging security standards.
Trusted by digital leaders across industries, including finance, healthcare, and entertainment, Jscrambler gives businesses the freedom to innovate securely.
Feel free to connect with our client-side security experts to learn how our solutions can help prevent digital skimming attacks.
