Hackers Target Real Estate Websites With Skimmer In Latest Supply Chain Attack
Threat actors leveraged a cloud-based video hosting service to carry out a supply chain attack on more than 100 real estate websites operated by Sotheby’s Realty that involved the injection of malicious skimmers to steal property. sensitive personal information.
“The attacker modified the static script at its hosted location by attaching the skimmer code. On the next player update, the video platform reinstated the compromised file and served it with the affected player.” the researchers said, adding that it worked with the video service and the real estate company to help remove the malware.
The campaign would have started as early as January 2021, according to MalwareBytes, with the information gathered – names, emails, phone numbers, credit card data – exfiltrated to a remote server “cdn-imgcloud[.]com “which also functioned as a collection domain for a Magecart attack targeting Amazon CloudFront CDN in June 2019.
To detect and prevent the injection of malicious code into online sites, it is recommended that you perform periodic web content integrity checks, including protecting accounts from takeover attempts and being careful to potential social engineering schemes.
“The skimmer itself is highly polymorphic, elusive and ever-changing,” the researchers said. “When combined with cloud distribution platforms, the impact of such a skimmer could be very significant. “