In new research from Malwarebytes Labs, it has been found that hundreds of fraudulent sites selling branded shoes are injected with a credit card skimmer. The purpose of the attackers is to steal both personal and financial data from shoppers by tricking them into visiting these fake merchandise retail shops.
The skimming code injected to the sites is appended to a JavaScript file called translate.js. These infected sites use outdated Magneto (prior to version 1.9.4.2) and PHP (version 5.6.40) software. This enabled the attackers to exploit the existing vulnerabilities and inject the card skimming malware. The malware steals several credit card details such as billing addresses and credit card numbers. Once compromised, the details are exfiltrated to a server in China at 103.139.113[.]34.
Here are some tips on how to reduce the risks associated with online shopping:
- Make sure that your computer is malware-free and running the latest patches. Leverage a security product that offers web protection. Malwarebytes’ flagship anti-malware product, as well as its newly introduced (and free) Browser Guard extension for Chrome and Firefox can thwart Magecart-related skimmers by blocking malicious scripts and websites from loading, as well as exfiltrating, data.
- If you are shopping on a site for the first time, check that it looks maintained. While this does not replace a thorough security scan, seeing notes such as “Copyright 2015” may indicate that the website is not really being looked after.
- Minimize how often you enter your credit card data by relying on other payment methods instead. For example, large reliable online retailers, such as Amazon already have your payment details archived into your account. Other safe methods include Apply Pay or prepaid Visa or Mastercards.
- Check your bank/credit card statements regularly to identify potentially fraudulent charges.
- Help prevent further attacks by reporting any fraudulent activity (especially if you were victim) to law enforcement authorities.
Indicators of Compromise (IOCs)
Counterfeit sites injected with skimmer
180workshoe[.]com
1freshfoot[.]com
2018nmd4u[.]com
234learnshoe[.]com
270takeshoe[.]com
365daysshoe[.]com
5923shoe[.]com
97saleweekly[.]com
987lateshoe[.]com
adsmithfwt[.]com
acheterftwr[.]com
addrubber[.]com
airmaxweekly[.]com
allsizeshoe[.]com
adnkclub[.]com
ashshoeslink[.]com
apparentshoe[.]com
auflaufschuh[.]com
utgumnshoes[.]com
awsnkrs[.]com
bajasprecio[.]com
basketouve[.]com
bestkixify[.]com
beastsole[.]com
best7now[.]com
bestshoesbf[.]com
blanchenmd[.]com
blazersoldes[.]com
boostrunner[.]com
boutiquesnks[.]com
brandingsit[.]com
breakerun[.]com
cageforlock[.]com
cestboncony[.]com
caretosole[.]com
champrun95[.]com
chaussureplace[.]com
cisalfaports[.]com
chamdot[.]com
chaussureprofile[.]com
colourmvp[.]com
compraestilos[.]com
closerpremium[.]com
closerselect[.]com
continuefeet[.]com
comfyftwr[.]com
cusmakeit[.]com
couleurmvp[.]com
courtadv[.]com
damesbedoor[.]com
ddtows[.]com
deeruptshoe[.]com
descubra19[.]com
docvab[.]com
donnescontate[.]com
dividesneakers[.]com
donectory[.]com
dryyourfoot[.]com
easeweekly[.]com
easyfootrun[.]com
energeticshoe[.]com
elementsthat[.]com
entryonlike[.]com
eternalapt[.]com
evidentshoe[.]com
febdate[.]com
farbasefull[.]com
farbenrun[.]com
farvefit[.]com
fleunderride[.]com
fewusedit[.]com
footbester[.]com
footrunclub[.]com
footsweek[.]com
footstijl[.]com
footstil[.]com
footstylish[.]com
foreasyon[.]com
for1sell[.]com
freernshoe[.]com
futureitblue[.]com
futureoiwill[.]com
futurenishoes[.]com
futureyouto[.]com
gelbneu[.]com
geschenkein[.]com
getgshoes[.]com
getbetternl[.]com
goldsoldes[.]com
grauwearim[.]com
grijsentop[.]com
goingtopurchase[.]com
grigiotopsu[.]com
greyheel[.]com
gsnkrs[.]com
guldafdk[.]com
headrebajas[.]com
hererunner[.]com
hjrshoe[.]com
inikirun[.]us
iweardam[.]com
jtsportsde[.]com
justshopclub[.]com
kaiisko[.]com
kaufenftwr[.]com
kaischuhe[.]com
kickfrstore[.]com
kickscrewstore[.]com
kickstienda[.]com
kickvapor[.]com
kickswinkel[.]com
kixifyshop[.]com
kixifyrun[.]com
kixifystore[.]com
kleurmvp[.]com
kleurschuhe[.]com
laufschuhebeste[.]com
linrubsole[.]com
lobeskoruns[.]com
lony19[.]com
lowesthalf[.]com
luckyisport[.]com
maxformob[.]com
manifestshoe[.]com
maximummost[.]com
metyshoes[.]com
mjftoods[.]com
mindedshoe[.]com
monitornon[.]com
msnkrs[.]com
nairschoenen[.]com
nairchaussure[.]com
nairscarpe[.]com
nairschuhe[.]com
nettstil[.]com
netwhilesale[.]com
newseftwr[.]com
newfeetreal[.]com
newmaxreal[.]com
newshoesreal[.]com
newstylereal[.]com
newwholereal[.]com
nicestijl[.]com
nicestil[.]com
nieuwekaufe[.]com
nicestilebay[.]com
nicestylebay[.]com
niceventefr[.]com
nmdforfemme[.]com
nmdrosare[.]com
nieuwekaufen[.]com
nmd5club[.]com
nmdnoir[.]com
nmdpksneaker4u[.]com
nmdoriginals[.]com
nmdreplace4u[.]com
nmdtrainers[.]com
noticeableshoes[.]com
noteystore[.]com
nuevorunning[.]com
nrdunkzpa[.]com
nrunnersale[.]com
nouveauhaven[.]com
nuevoshoe[.]com
nuovehaven[.]com
obviousshoe[.]com
offwschuhe[.]com
oplev19[.]com
oroshoesit[.]com
ordinarytrend[.]com
oroboostpas[.]com
outlet3prix[.]com
outletsfire[.]com
particleprovide[.]com
paschernoir[.]com
perpetuallook[.]com
pearlshoeslink[.]com
perpetualfree[.]com
phlshoe[.]com
pickonsneakers[.]com
pinkshoeslink[.]com
ponashoes[.]com
porsneakers[.]com
premiumnuevo[.]com
poshseeking[.]com
profilesshoe[.]com
prophereshoe[.]com
psbeautytre[.]com
racersho[.]com
runnerfr[.]com
ozemetoen[.]com
rosakopen[.]com
run4kick[.]com
rubberplat[.]com
runnerdry[.]com
runstormon[.]com
saledksko[.]com
saldifire[.]com
sarezalando[.]com
scarpekingdom[.]com
scarpe-new[.]com
scarpastate[.]com
schoenenbeste[.]com
schoenenprofile[.]com
schuherunlau[.]com
schuhesize[.]com
schuhneu[.]com
schuheplace[.]com
schuheprofile[.]com
scopri19[.]com
showam97[.]com
shoehallrun[.]com
sizehaven[.]com
showschuh[.]com
skorunvit[.]com
sjjshoe[.]com
skoprofile[.]com
skonmd[.]com
snadnket[.]com
sneakerbyside[.]com
sneakerebe[.]com
sneakerees[.]com
sneakermodelli[.]com
sneakerunow[.]com
snkrsstrike[.]com
snugfree[.]com
snstuff[.]us
sortheads[.]com
sort5sko[.]com
sportkopen[.]com
sportinghave[.]com
sportopwears[.]com
sports-be[.]com
sportsalebay[.]com
sportsneu[.]com
sportsonfr[.]com
sports-ha[.]com
stayonlinese[.]com
sprishoes[.]com
startingnice[.]com
streetcolouring[.]com
stripeschuhe[.]com
stuffnuevo[.]com
stuffkicks[.]com
stuffkopen[.]com
stuffoutfr[.]com
stuffpknit[.]com
styleftwr[.]com
stvprxsko[.]com
styleschoen[.]com
styleschuh[.]com
stylezapato[.]com
suitableshoe[.]com
swzoomsch[.]com
texmedever[.]com
tehshoes[.]com
takerightback[.]com
tedschuhe[.]com
thegodwillout[.]com
thxshoe[.]com
tiendaout[.]com
tosomtosideaway[.]com
trainernmdcbk[.]com
trainersnmd[.]com
tstripeseqt[.]com
uomoweekly[.]com
usesmoother[.]com
usualshares[.]com
valuablemax[.]com
vertchausfr[.]com
verstaleshoes[.]com
vtfreencs[.]com
vvvfabrices[.]com
walkingnice[.]com
wearingselect[.]com
willgoout[.]com
willrunalong[.]com
willrunout[.]com
willhiking[.]com
winatershoes[.]com
wmboost[.]com
withnormal[.]com
willtrval[.]com
witroze[.]com
wmsnkrs[.]com
wsnkrs[.]com
zapatosnmd[.]com
zwtnlzsen[.]com
Counterfeit sites pose a double threat to online shoppers. Therefore, shoppers should ensure the legitimacy of the site before visiting it.The research highlight,” If you are shopping on a site for the first time, check that it looks maintained. It is also important to make the computer malware-free by running the latest patches and using security products that offer web protection.
