Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Anatomy of Formjacking Attacks

Summary: Formjacking injects malicious JavaScript into a site's checkout form so that when a user clicks submit, the payment details are sent to an attacker's command-and-control server while the original purchase still completes normally. Unit 42 names British Airways, Ticketmaster, Delta, Newegg and Topps.com as sites compromised this way, and notes one sample (SHA256 a79da1f0...) was flagged as malicious by only three entities on VirusTotal as of April 8, 2020.

Why it matters: The customer gets the product and sees nothing wrong, so the theft surfaces only in card-fraud data - and a sample still detected by just three VirusTotal engines shows how thin signature coverage is for this code.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related