Crafty Web Skimming Domain Spoofs “https”
Summary: KrebsOnSecurity alerted Cheney Bros. Inc., the 10th largest U.S. food distributor, that its grandwesternsteaks.com checkout and login pages had been hacked with code stealing credit card and login data via a malicious domain, http[.]ps, which spoofs the look of 'https://'. The domain, registered Feb. 7 and hosted in Russia alongside a data-collection domain called autocapital[.]pw, appeared on nearly a dozen other sites including a music instrument retailer, a European herbal pharmacy, and a Spanish seller of programmable logic controllers, and the malicious code has since been removed from grandwesternsteaks.com.
What's compelling: The trick exploits the fact that since Chrome version 76 the 'https' scheme is no longer shown to users, so a domain like http[.]ps can pass a casual glance in source code - and Malwarebytes ties the obfuscation to site-hacking campaigns dating back to 2016, meaning your checkout pages may already carry code your AppSec team never reviewed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026