A sophisticated credit card skimmer malware has been discovered targeting WordPress websites. The malware injects malicious JavaScript into database entries, specifically in the wp_options table, to steal sensitive payment details from checkout pages. It activates only on checkout pages, either hijacking existing payment fields or injecting a fake credit card form. The malware uses Base64 encoding and AES-CBC encryption to obfuscate stolen data before sending it to attacker-controlled servers. This stealthy approach allows the malware to persist undetected on compromised sites, avoiding common file-scanning tools. The attack demonstrates the evolving techniques used by attackers to target sensitive checkout processes in WordPress environments. Author: AlienVault
Related Tags:
ecommerce
credit card skimmer
T1056.003
T1592.002
T1059.007
T1132.001
WordPress
T1071.001
T1185
Associated Indicators:
valhafather.xyz