Credit Card Skimming Surges Ahead of Holiday Shopping Season

As the shopping season approaches, there is a concurrent rise in cyber threats, with credit card skimming emerging as a significant concern, according to an article by Malwarebytes. The vulnerability lies in the security of online stores, which may not be as robust as consumers assume. When these platforms are hacked, the sensitive credit card information of users becomes susceptible to interception by cybercriminals, often through concealed malicious code.

A notable credit card skimming campaign, known as the Kritec campaign, has gained momentum since October, targeting hundreds of online stores. This operation, first identified in March 2023, distinguished itself by its extensive volume and the customization of skimming techniques for each victim site. The skimmers utilized convincing templates, localized in multiple languages, creating a seamless experience for users, rendering it difficult for them to detect that their credit card information had been compromised.

The campaign experienced a surge in April, followed by a slowdown during the summer, only to intensify again in October, reaching its peak volume. The measurement of activity was based on the number of newly registered domain names linked to the threat actor, with the infrastructure located on the IT WEB LTD network in the British Virgin Islands.

To ensure safe online shopping, especially on smaller merchant websites, users are advised to exercise caution. Without the ability to conduct a comprehensive website audit, consumers cannot guarantee a platform’s security. Signs of an outdated website, such as displaying old copyright information, may indicate potential compromise.

Most compromises occur due to outdated content management systems and vulnerable plugins. Tools that can detect malicious code embedded in websites, as well as antivirus products offering web protection, are recommended. Given the dynamic nature of cyber threats, heuristic detection for elements like malicious JavaScript snippets is also advisable. Staying vigilant and adopting these precautions becomes crucial as the holiday season approaches.