According to BleepingComputer, the researchers found a legitimate donation collection website for the Australia bushfire under a credit-card skimming attack. They noticed a malicious skimmer ‘ATMZOW’ script running on the checkout page of the website.
https://twitter.com/MBThreatIntel/status/1215693928764063744
- MBThreatIntel
Digging further into the code it was revealed that the script pilfered donor’s payment information from the checkout page. It then submitted the data to a domain vamberlo.com obfuscated in the script.
According to Troy Mursch, the same script affected 39 other websites as well. However, it isn’t clear whether the script utilized the same domain as that of the bushfire donation site.
https://twitter.com/bad_packets/status/1215726048769273856
- bad_packets
All other websites (if the MageCart code running on them utilized vamberlo.com as domain), as well as the Australia bushfire donation site, are now seemingly safe.
However, the malicious script is still running on the infected websites, at least on the bushfire donation site. Therefore, it is possible the attackers may modify the script at any time to run the skimmer again.
Credit card skimming attacks have been infecting various businesses and websites for quite a long time. And now, with the latest infection on a donation website, it is clear that the MageCart attackers don't really care where they make a buck.
Let us know your thoughts in the comments.
