Segway e-store suffered a Magecart attack that potentially allowed threat actors to steal credit cards and customer info.
The online store of Segway was compromised as a result of a Magecart attack, threat actors planted a malicious script to steal credit card data and customer information while visitors were making a purchase
Segway is known for the design of the two-wheeled, self-balancing personal transporter invented by Dean Kamen, the company also produces other human transportation devices.
Malwarebytes researchers spotted a web skimmer on Segway’s online store (store.segway.com) and linked the attack to Magecart Group 12.
Researchers noticed the Segway store was contacting a known skimmer domain (booctstrap[.]com) which has been active since November and involved in previous Magecart attacks.
The store is running the Magento CMS, threat actors used to compromise them by exploiting vulnerabilities in vulnerable versions of the CMS itself or one of its plugins.
The analysis of urlscanio data revealed that the site of Segway was compromised at least since January 6th.
Attackers added JavaScript to Segway’s online store that pretended to display the site’s copyright, but that was used to load an external favicon that contained the e-skimming code.
“The threat actors are embedding the skimmer inside a favicon.ico file. If you were to look at it, you’d not notice anything because the image is meant to be preserved. However, when you analyze the file with a hex editor, you will notice that it contains JavaScript starting with an eval function.” reads the analysis published by Malwarebytes.
Magecart Group 12 group has been active since at least 2019 when he carried out a large-scale operation against OpenCart online stores.
Malwarebytes immediately shared its findings with the company.
“The compromise of the Segway store is a reminder that even well-known and trusted brands can be affected by Magecart attacks. While it usually is more difficult for threat actors to breach a large website, the payoff is well worth it.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Magecart)
[adrotate banner=”5″]
[adrotate banner=”13″]
