Credit card-skimming threat Magecart has reportedly compromised more than 2 million victim websites and directly breached more than 18,000 hosts, RiskIQ researchers report.
RiskIQ's first observation of Magecart was back in 2010, but the threat has recently been ramping up as more attackers learn how to compromise websites. Supply chain attacks are responsible for the biggest spikes in Magecart detections, the largest of which took place on June 27, 2018, when Ticketmaster reported a breach conducted by Magecart. Third-party shopping platforms like Magento and OpenCart remain popular Magecart targets; RiskIQ has detected 9,688 vulnerable Magento hosts, researchers say in a new report on the threat.
Some groups are taking advantage of digital advertising to bring more traffic to infected checkout pages: Seventeen percent of all malvertisements detected by RiskIQ are controlled by Magecart.
The average length of a Magecart breach is 22 days; however, many last years and some are indefinite. Its infrastructure contains 573 known command-and-control domains and 9,189 hosts observed loading C2 domains. There are now dozens of known Magecart groups, and researchers have begun connecting some of these groups with known cybercrime groups.
Read more details of the report, "Magecart: The State of a Growing Threat," here.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Rethinking Cybersecurity Hiring: Dumping Resumes & Other 'Garbage.'"