# Magecart Group Compromises Plugin Used in Thousands of Stores, Makes Rookie Mistake

**bleepingcomputer.com/news/security/magecart-group-compromises-plugin-used-in-thousands-of-stores-makes-**
rookie-mistake/

Ionut Ilascu

By
[Ionut Ilascu](https://www.bleepingcomputer.com/author/ionut-ilascu/)

October 9, 2018
09:00 AM
0

A group behind recent Magecart campaigns made a mistake that could have cost
thousands of web stores the payment card data of their customers when they checked out.

The cybercriminals managed to compromise the popular Shopper Approved plugin used by
online merchants to collect customer reviews and ratings. The plugin helps increase
visibility by displaying the reviews in strategic locations through advertising networks from
Google or Microsoft.

Security researchers from digital risk management company RiskIQ received an alert on
September 15 from their systems for positive identification of the Magecart skimming code
in the certificate.js script of the Shopper Approved seal code.

The investigation revealed that the attackers injected the code without applying any
obfuscation, which made it easy to detect and identify. Aware of the mistake, they returned
about 15 minutes later and modified the skimmer to hide it.


-----

Deobfuscated Magecart card-skimming script
This blunder, although minor, was enough to let researchers view the clean code without
having to resort to deobfuscation techniques.

Obfuscated code, 15 minutes later


-----

Of note is the drop server set up by the attackers to receive the payment card data, which is
[the same used in the Feedify hack, a month ago.](https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/)

RiskIQ used several channels of communication to alert Shopper Approved of the
compromise and help them mitigate the issue. Two days later, the skimmer code was
removed from the store review widget. An investigation was also started to learn the source
of the compromise.

“While Shopper Approved is active on thousands of websites, only a small fraction of their
[clients were impacted,” RiskIQ says in a report shared with BleepingComputer in advance.](https://www.riskiq.com/blog/labs/magecart-shopper-approved/)

Shopper Approved identified clients that loaded the compromised script and contacted them
to help remediate the issues.

## At least seven groups associated with Magecart campaigns

Magecart is the term used for multiple groups that either compromise shopping websites
directly or go further up the stream and infect plugins used by a large number of online
stores, in an attempt to score big.

At the moment, RiskIQ distinguishes between seven groups, some of them responsible for
the [Ticketmaster,](https://www.bleepingcomputer.com/news/security/ticketmaster-announces-data-breach-affecting-5-percent-of-all-users/) [British Airways, Feedify, and](https://www.bleepingcomputer.com/news/security/british-airways-fell-victim-to-card-scraping-attack/) [Newegg breaches.](https://www.bleepingcomputer.com/news/security/newegg-credit-card-info-stolen-for-a-month-by-injected-magecart-script/)

The recommendation from the experts is to remove third-party code from checkout pages.
Many payment service providers have already adopted this practice, RiskIQ informs.

[The Magecart threat is unlikely to disappear any time soon. In fact, a sharp increase in the](https://www.bleepingcomputer.com/news/security/magecart-attacks-grow-rampant-in-september/)
number of attacks has been spotted in September by multiple security outfits.

[Ionut Ilascu](https://www.bleepingcomputer.com/author/ionut-ilascu/)

Ionut Ilascu is a technology writer with a focus on all things cybersecurity. The topics he
writes about include malware, vulnerabilities, exploits and security defenses, as well as
research and innovation in information security. His work has been published by
Bitdefender, Netgear, The Security Ledger and Softpedia.

[Previous Article](https://www.bleepingcomputer.com/news/security/windows-10-ransomware-protection-bypassed-using-dll-injection/)
[Next Article](https://www.bleepingcomputer.com/news/google/google-pixel-3-and-pixel-3-xl-unveiled/)

Post a Comment [Community Rules](https://www.bleepingcomputer.com/posting-guidelines/)

You need to login in order to post a comment

[Not a member yet? Register Now](https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register)

### You may also like:


-----