Hackers Target Real estate websites with skimmer in latest supply chain attack

Threat actors used a cloud-based video hosting service to perform a supply chain attack on more than 100 real estate websites operated by Sotheby’s Realty that involved the injection of malicious skimmers to steal sensitive personal information .

“Others import videos, even their websites are embedded with skimmer codes,” researchers from Unit 42 at Palo Alto Networks said in a report released this week.

The skimmer attacks, also called formjacking, relates to a type of cyber attack wherein bad actors insert malicious JavaScript code into the target website, most often to checkout or payment pages on shopping and e-commerce portals, to harvest valuable information such as credit card details entered by users.

In the latest incarnation of the Magecart attacks, the operators behind the campaign hacked Sotheby’s Brightcove account and deployed malicious code in the cloud video platform player by forging a script that can be loaded to add JavaScript customizations to the video player.

“The attacker modified the static script in his hosted location by attaching the skimmer code. On the next player update, the video platform reingested the compromised file and served it with the affected player.” the researchers said, adding that he had worked with the video service and the real estate company to help remove the malware.

The campaign is said to have begun as early as January 2021, according to MalwareBytes, with the harvested information — names, emails, phone numbers, credit card data — exfiltrated to a remote server “cdn-imgcloud[.]com” that also functioned as a collection domain for a Magecart Attack targeting Amazon CloudFront CDN in June 2019.

To detect and prevent the injection of malicious code into online sites, it is recommended that you perform periodic web content integrity checks, remembering to protect accounts from takeover attempts and pay attention to potential social engineering schemes.

“The skimmer itself is highly polymorphic, elusive and ever-changing,” the researchers said. “When combined with cloud distribution platforms, the impact of such a skimmer could be very significant.