Hackers Hide Credit Card Skimmers in Swap Files: How Your E-commerce Site Could Be Next
Threat actors are using swap files to hide persistent credit card skimmers on compromised websites. This sneaky technique, seen on a Magento e-commerce site, helps malware survive cleanup attempts and exfiltrate payment data. Security experts advise restricting protocols like SSH to trusted IPs and keeping systems up-to-date.
Hot Take:
Just when you thought your credit card info was safe, cyber crooks are playing hide and seek with your data like it’s a game of Where’s Waldo. Pro tip: Waldo wins.
Key Points:
- Threat actors are using swap files to conceal credit card skimmers on compromised websites.
- The malware was observed on a Magento e-commerce site’s checkout page.
- Stolen data is exfiltrated to a domain that mimics Amazon’s analytic services.
- Malware persists on the site by exploiting swap files created during SSH sessions.
- Compromised WordPress sites are being hit with a malicious plugin masquerading as Wordfence.
Already a member? Log in here