Web Skimmer Hides Within EXIF Metadata

Summary

Cyber-criminals are using the increase in online shopping to conduct cyber-attacks, such as Magecart attacks, in which a web skimmer is used to steal payment card information while evading detection. Malwarebytes Lab discovered a new steganography technique in which skimming code is hidden within the EXIF metadata of an image file and then secretly loaded onto compromised online stores to exfiltrate credit card data. The extraneous code, appended to the legitimate script hosted by the merchant, loads a favicon file that uses the "Copyright" metadata field to load the web skimmer. Online stores running the WooCommerce plugin for WordPress are increasingly targeted due to its large market share.

Recommendations

The NJCCIC recommends website administrators block access to sensitive information entered into web forms and stored cookies. We also advise users to make purchases with credit cards when shopping online as they often have better consumer fraud protections than debit cards. For more technical details, please review the Malwarebytes blog post.