Magecart now hides malicious PHP web shells behind website favicons to maintain persistent access.
The researchers noticed the new Magecart attack strategy exploiting favicons while scanning websites. They deduced that the campaign is active in the wild that links back to the Magecart Group 12. It is the same group that targeted numerous Magento 1.x websites in the previous year. Currently, preventing this type of attack is difficult from the website admins’ perspective. Yet, vigilant monitoring may help in detecting a malicious code right when it loads. The skimmer we showed… dynamically injects code into the merchant site. The request to the malicious domain hosting the skimming code is not made client-side but server-side instead. As such a database blocking approach would not work here unless all compromised stores were blacklisted, which is a catch-22 situation. A more effective, but also more complex and prone to false positives approach, is to inspect the DOM in real-time and detect when malicious code has been loaded. However, users can avoid losing their payment details to the attackers. The researchers advise users to use security software and tools that offer protection against malicious websites.