Category Archives: RiskIQ

Who’s In Your Online Shopping Cart?

Posted on by

Crooks who hack online merchants to steal payment card data are constantly coming up with crafty ways to hide their malicious code on Web sites. In Internet ages past, this often meant obfuscating it as giant blobs of gibberish text that is obvious even to the untrained eye. These days, a compromised e-commerce site is more likely to be seeded with a tiny snippet of code that invokes a hostile domain which appears harmless or that is virtually indistinguishable from the hacked site’s own domain. Continue reading Who’s In Your Online Shopping Cart?→

British Airways has some good news and bad news about its payment breach

Posted on by

British Airways has made significant revisions to its account of how many payments may have been compromised in a card-skimming breach the airline reported last month. Additional incidents have been discovered, but the original reported exposure was smaller than announced, the company said. The company said on Thursday that it identified an additional window of time when payments were exposed by hackers, and is freshly notifying about 185,000 affected accounts. Of the new number, the airline says that 77,000 card holders had basic billing information as well as card number, expiration date and CVV (the security code usually on the back of the card) exposed. The other 108,000 did not have the CVV exposed. The airline says the newly identified incidents involve rewards bookings between April 21 and July 28. Those dates are separate from British Airways’ initial disclosure last month. British Airways said at the initial disclosure in September that it notified 380,000 customers of the […]

The post British Airways has some good news and bad news about its payment breach appeared first on Cyberscoop.

Continue reading British Airways has some good news and bad news about its payment breach→

Magecart hacks Shopper Approved to simultaneously hit many e-commerce sites

Posted on by

The cybercriminal groups under the Magecart umbrella strike again and again, and one of them has apparently specialized in compromising third parties to more easily get in as many online shops as possible. The latest target of Magecart Group 5, as it h… Continue reading Magecart hacks Shopper Approved to simultaneously hit many e-commerce sites→

Magecart group compromises customer ratings tool, affecting ‘hundreds’ of online stores

Posted on by

Researchers with RiskIQ say they have uncovered and helped resolve a credit card-skimming threat that targeted a third-party web app that manages customer reviews.  The company attributes the threat to Magecart, a loosely associated set of hacking groups that exploit vulnerabilities in widely used third-party scripts. Magecart has been linked to similar payment data breaches with Ticketmaster UK, Newegg, British Airways and others. But Yonathan Klijnsma, head researcher at RiskIQ, explained to CyberScoop that Magecart is more of an umbrella term to describe the independent groups that exchange and imitate other groups’ procedures. In this case, RiskIQ says that a tool made by e-commerce software company Shopper Approved was compromised by Magecart threat actors, giving them the ability to skim payment information from the checkout pages of “a few hundred” online stores using the tool. RiskIQ labels this Magecart group “Group 5” and says it’s the same one that targeted Ticketmaster. The tool […]

The post Magecart group compromises customer ratings tool, affecting ‘hundreds’ of online stores appeared first on Cyberscoop.

Continue reading Magecart group compromises customer ratings tool, affecting ‘hundreds’ of online stores→

It only takes one data point to blow open a threat investigation

Posted on by

Because cybersecurity has been such a pain point for businesses, it’s easy to assume that threat investigations are difficult and unwieldy to manage. When you consider what’s at stake—customer data, sensitive company and client information, and the fin… Continue reading It only takes one data point to blow open a threat investigation→

New Magecart victims ABS-CBN and Newegg are just the tip of the iceberg

Posted on by

With the Magecart attackers compromising web shops left and right, online shopping is becoming a risky proposition. After Ticketmaster, British Airways and Feedify, two new Magecart victims have been identified: the broadcasting giant ABS-CBN and onlin… Continue reading New Magecart victims ABS-CBN and Newegg are just the tip of the iceberg→

Magecart strikes again, this time at electronics retailer Newegg

Posted on by

Code has been discovered siphoning credit card numbers from consumer technology retail website Newegg, according to security researchers from two cybersecurity companies. In reports published Wednesday by RiskIQ and Volexity, researchers discovered instances of code liked to the operators of Magecart, a group that has been behind a slew of recent, high-profile credit card number breaches. Thieves have been siphoning credit card data since Aug. 14, when a piece of Javascript was inserted into Newegg’s payment sites. That code pulled credit card numbers and sent them to a site with a similar URL — neweggstats[.]com. According to Volexity, the code wasn’t removed from the Newegg payment site until Tuesday. Newegg is an extremely popular retailer, ranking 161 on Alexa’s list of top websites in the U.S. According to SimilarWeb, the site receives 50 million visitors a month. “Over an entire month of skimming, we can assume this attack claimed a […]

The post Magecart strikes again, this time at electronics retailer Newegg appeared first on Cyberscoop.

Continue reading Magecart strikes again, this time at electronics retailer Newegg→

Magecart compromises Feedify to get to hundreds of e-commerce sites

Posted on by

Customer engagement service Feedify has been hit by Magecart attackers, who repeatedly modified a script that it serves to a few hundred websites to include payment card skimming code. The current situation The compromise was first flagged by someone w… Continue reading Magecart compromises Feedify to get to hundreds of e-commerce sites→

British Airways breach was effected by Magecart attackers

Posted on by

The British Airways breach was the work of a well-known criminal group dubbed Magecart, which managed to put payment card skimming code on the company’s website, says RiskIQ researcher Yonathan Klijnsma. The group has been compromising online sho… Continue reading British Airways breach was effected by Magecart attackers→