Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection

Tags

External References

• https://blog.sucuri.net/
• https://otx.alienvault.com/

Description

A sophisticated credit card skimmer malware has been discovered targeting WordPress websites. The malware injects malicious JavaScript into database entries, specifically in the wp_options table, to steal sensitive payment details from checkout pages. It activates only on checkout pages, either hijacking existing payment fields or injecting a fake credit card form. The malware uses Base64 encoding and AES-CBC encryption to obfuscate stolen data before sending it to attacker-controlled servers. This stealthy approach allows the malware to persist undetected on compromised sites, avoiding common file-scanning tools. The attack demonstrates the evolving techniques used by attackers to target sensitive checkout processes in WordPress environments.

Date