Credit Card Skimming Campaign Targets Websites Running ASP.NET

Summary

Credit card skimmers are typically found on websites using the widely-adopted Linux-based stacks; however, this skimming campaign was discovered on at least a dozen websites using Windows-based stacks and has been active since mid-April 2020. The identified websites ran shopping cart applications and were hosted on Microsoft IIS servers running ASP.NET web framework version 4.0.30319, which is no longer supported and contains multiple vulnerabilities. Cyber-criminals inject the skimming code remotely or directly into the compromised JavaScript library of the affected website to steal credit card numbers and passwords, which are exfiltrated through the same domain in a GET request as a GIF image file.

Recommendations

The NJCCIC recommends organizations monitor their systems for malicious activity and follow the recommendations provided in the previous threat alert. Technical details and Indicators of Compromise (IoCs) can be found in the Malwarebytes blog post.