Thread by @AffableKraut

Saw this new digital skimmer/#magecart JS for the first time last week. Haven't had time to dig really deep into it, but here's the basic overview. Calling it the Callback skimmer for now. Above average JS for a digital skimmer.

1/9

As I said, this is going to be a quick overview. Here's the loader:
gist.github.com/krautface/5a29…

2/9

That calls out to hxxps://jquery-cycle[.]com/analytics.js?q=0.44886615665744056 which returns the following code: gist.github.com/krautface/91c6…

It is encoded, but the Callback loader decodes it and runs it. If I recall correctly, that code just makes the same call again.

3/9

The code has added the same script tag to the header twice now. This was from another time it loaded, you can see the q= value is different, and I think this may affect some of the encoding, but I'm not 100% about that.

3.5/9

The second time, however, the actual skimmer comes through. Here's the second stage payload, which is much bigger than the first:

gist.github.com/krautface/3b3a…

4/9

The loader again decodes the payload and the result is this full skimmer.

gist.github.com/krautface/9ebc…

5/9

Lines 1-99 are two copies of some unrelated code, as far as I can tell it's originally from a plugin for protecting yourself from companies using the Canvas to fingerprint your browser. Another attempt at hiding the malicious JS from a quick review.

6/9

A couple of quick notes. Some standard anti-RE stuff in play here that's pretty easy to get rid of. Line 150 has what is likely the exfil URL:

hxxps://jquery-cycle[.]com/api/api.php

7/9

Line 233 is an encoded list of field names. Here they are decoded.

8/9

Anyways, like we've seen in other places recently, some of these skimmers are starting to look like they're built by actual devs, not just people pounding on JS until they get something that mostly works. Not that this code would pass a code review, but it's getting better.

9/9