The market leader in Client-side Security for websites, providing real-time threat detection, protection and prevention of JavaScript vulnerabilities.
Joined December 2011
- Tweets667
- Following296
- Followers831
- Likes209
Source Defense retweeted
🚨#magecart alert! statsmeter[.]co/init.js?5003211 mimics the
@Stripe
payment page on an American merchant. sending the stolen #payment data to himself. Maybe related to this xitter.cf/sdcyberresearch/status…
#PCIDSS #DataSecurity #FormJacking
Another #magecart attack was found with a convincing mimic of a payment provider.
statsmetrica[.]co/init.js?4025525 fakes the @BanquePopulaire payment form, on a French merchant #ecommerce website.
#PCIDSS #DataSecurity #FormJacking
Source Defense retweeted
Another #magecart attack was found with a convincing mimic of a payment provider.
statsmetrica[.]co/init.js?4025525 fakes the @BanquePopulaire payment form, on a French merchant #ecommerce website.
#PCIDSS #DataSecurity #FormJacking
Source Defense retweeted
A #magecart attack on worldwide #ecommerce was found stored on GitHub IO.
The attack Includes files from the subdomain dfsdjfheuu8.github[.]io:
/seos/r.js
/seos/config.js
/seos/v57.js
And the file:
susial.github[.]io/calc/index.html
#PCIDSS #DataSecurity #FormJacking
Source Defense retweeted
🚨ALERT: #magecart attack. Source Defense's research reveals a new skimmer from the domain cdn.cacheloading[.]com. 💳 payment data from #Ecommerce siphoned via GET requests to the domain tracking[.]services[.]bz. Stay vigilant!
#magecart #formjacking #DataBreach #CyberSecurity
Source Defense retweeted
🚨ALERT: #magecart attack. Source Defense's research reveals a new skimmer from the domain cdn.indicalive[.]com (IP 109.234.34[.]109). 💳 payment data from #Ecommerce siphoned via fetch request to indicalive[.]com. Stay vigilant!
#magecart #formjacking #DataBreach #CyberSecurity
Source Defense retweeted
🚨 ALERT: #magecart attack. Source Defense's research reveals a new skimmer from cdn.omapapi[.]com/tools.min.js/package (199.188.206[.]68). 💳 Payment data from #Ecommerce siphoned via fetch requests to the same domain. Stay vigilant!
#magecart #formjacking #DataBreach #infosec
Source Defense retweeted
Alert! #magecart attack! US #ecommerce sites are under attack by several #magecart JSs from a legit(?) #ecommerce luluatalmaghrib[.]com from Dubai. Stolen payment data is sent to cdn-report[.]com. Stay vigilant! #formjacking #DataBreach #infosec
Source Defense retweeted
Another one: https://www.googletagmanager[.]com/gtm.js?id=GTM-KDBGH499
#magecart
Source Defense retweeted
Is this what I am supposed to get after selecting the PayPal option?
The script static.webagencyanalytics[.]com/main.js?v=1.2.7 fakes a payment form and steals payment data from #ecommerce. The data is sent to the same domain. IP: 212.118.53[.]134.
#magecart #DataBreach #infosec
Source Defense retweeted
🚨 ALERT: New #magecart attack. Source Defense's research reveals a new malicious JS from hxxps://xploit[.]im/generator/ 💳 Credit card data from #Ecommerce siphoned to the same domain.
Stay vigilant!
#magecart #infosec #CyberSecurity #webskimming #DataBreach #formjacking
Source Defense retweeted
🚨 ALERT: New #magecart attack. Source Defense's research reveals a new malicious JS from hxxps://odinmob[.]shop/karendidion-loader.js 💳 Credit card data from #Ecommerce siphoned to the same domain.
Stay vigilant!
#infosec #CyberSecurity #webskimming #DataBreach #formjacking
Source Defense retweeted
🚨Alert! Source Defense research found a #magecart attack.
An inline script is initiating a fetch request to keytoc[.]online, retrieving malicious JS from various domains.
Payment data from worldwide #ecommerce sites have been siphoned.
#DataBreach #formjacking #pcidss
(1/2)
Source Defense retweeted
🚨 Alert! Source Defense research found a #magecart attack.
An inline script is initiating a fetch request to bomtech[.]site, retrieving malicious JS from dvtmob[.]shop.
💳Payment data from worldwide #ecommerce websites have been siphoned.
#DataBreach #formjacking #pcidss
Source Defense retweeted
🚨#magecart alert! The known skimmer from gstatis[.]co is loaded now from Google Tag Manager. This is the same method as his friend jsdelivr[.]at (both use the IP 185.215.113[.]111)
GTM IDs:
GTM-5VV5ZFS6
GTM-NWZQS5QC
GTM-5N3X6KD9
GTM-KNZTJZ6G
#ecommerce #formjacking #pcidss
Source Defense retweeted
Source Defense retweeted
Another skimmer from the same IP (5.188.86[.]197):
hxxps://keepstat[.]shop/cdn/absorberr.com.js also sends the data twice to two different domains.
#magecart #formjacking #pcidss #DataBreach
Source Defense retweeted
What do underwear and a machine manufacturer have in common?
They are both legit ecommerces that were hacked and host a skimmer that attacks other #ecommerce websites, the payment data is sent to a telegram bot (the address in the first comment).
#magecart #formjacking #pcidss
Source Defense retweeted
Find the differences, a new #magecart attack fakes the payment form and steals the data.
The JS loaded from ganalyticsmanager[.]com/js/f336fcf927bc87fba9a43a5c5e8cbc74.js Stolen data from #Ecommerce sent to the domain bgxjymfky29ycde[.]com.
#pcidss #DataBreach #formjacking
Source Defense retweeted
🚨ALERT: #magecart attack. Source Defense's research reveals a new malicious JS from hxxps://goourlcns[.]com/mail loaded from a Google Tag Manager id=GTM-NQNJGSRW.
💳Credit card data from #Ecommerce siphoned to the same domain.
#infosec #DataBreach #formjacking #pcidss
Source Defense retweeted
Recent findings by Source Defense reveal a surge in #magecart attacks, alarmingly originating from legit domains. Among these are googletagmanager[.]com, firebasestorage.googleapis[.]com, github[.]io, and others, where malicious JS have been detected.
#Formjacking #DataBreach
