WordPress Plugin abused to install e-skimmers in e-commerce sites

Threat actors are exploiting a WordPress plugin to insert malicious PHP code in e-commerce sites and steal credit card data. Sucuri researchers observed threat actors using a PHP snippet WordPress plugin to install malicious code in WooCommerce e-stores and harvest credit card details. In the campaign spotted by the experts, attackers use a very obscure […]

May 28, 2024

Threat actors are exploiting a WordPress plugin to insert malicious PHP code in e-commerce sites and steal credit card data.

Sucuri researchers observed threat actors using a PHP snippet WordPress plugin to install malicious code in WooCommerce e-stores and harvest credit card details.

In the campaign spotted by the experts, attackers use a very obscure WordPress plugin called Dessky Snippets, which has only a few hundred active installations at the time of writing.

Dessky Snippets is a lightweight and simple plugin that gives users the ability to easily add custom PHP code from WordPress admin.

The campaign occurred on May 11th, and the researchers observed a surge in downloads of the Dessky Snippets plugin from that same day. At this time, the WordPress plugin has over 200 active installations.

Attackers exploited the Dessky Snippets plugin to insert a server-side PHP credit card e-skimmer.

“This malicious code was saved in the dnsp_settings option in the WordPress wp_options table and was designed to modify the checkout process in WooCommerce by manipulating the billing form and injecting its own code.” reads the analysis published by Sucuri.

The malware has two main components. The first part uses a fake function named “twentytwenty_get_post_logos()” to hook into WooCommerce’s billing form. The function adds additional fields to the billing form to request credit card details earlier than usual. The second part involves an obfuscated credit card skimmer that monitors POST data for specific parameters. When the malware detects these parameters, it sends all the collected billing and credit card information to a third-party URL “hxxps://2of[.]cc/wp-content/”.

The researchers noticed that the billing form associated with the overlay used by the attackers has the autocomplete feature disabled, The fields are set with autocomplete=”off”.

Disabling the auto-fill feature on the fake checkout form is an evasion trick that reduces the chances of the browser warning users about entering sensitive information. The fields remain blank until manually filled out, making them look like regular, necessary inputs for the transaction and reducing user suspicion.

“In essence, ecommerce sites are prime targets for hackers due to the valuable data they handle.” concludes the report. “Here’s a simple guide to protect your online store:

Keep your software patched: Regularly update your CMS, plugins, themes, and any third-party components to patch vulnerabilities.
Use strong passwords: Ensure all accounts, including admin, sFTP, and database credentials, have strong and unique passwords.
Select trusted scripts: Only integrate third-party JavaScript from reputable sources. Avoid unnecessary third-party scripts.
Monitor for threats: Regularly check your site for signs of malware, unauthorized changes, or any indicators of compromise.
Implement a firewall: Use a web application firewall to block malicious bots, virtually patch known vulnerabilities, and filter harmful traffic.
Set up a CSP: Establish a Content Security Policy (CSP) to protect against clickjacking, cross-site scripting (XSS), and other threats.”