Double-Entry Web Skimming Attack Campaign Hits 17 Websites
Document Control
Double-Entry Web Skimming Attack Campaign Hits 17 Websites
Document No:
Revision Status:
Effective Date:
Last Review Date:
Approved by
Preparer Name:
Signature
Date:
Document Revision History
Publication Date Author Revision No Change Description
Initial Document
-
Creation
Table of Contents
1. Introduction
2. Incident Overview
3. Attack Methodology
4. Indicators of Compromise (IoCs)
5. Recommendations
6. Conclusion
7. References
Introduction
A recent investigation has uncovered a significant web skimming campaign that compromised at
least 17 websites, including the UK site of electronics giant Casio. These attacks exploited
vulnerabilities in Magento and similar e-commerce platforms, posing significant risks to
sensitive customer data.
Incident Overview
The campaign was first detected on January 28, 2025, by Jscrambler, a client-side web security
provider. The infection impacted Casio's UK website (casio.co.uk) along with 16 other
unidentified websites. Unlike typical skimming attacks, this campaign targeted the cart page
rather than the checkout page, redirecting users to a fake multi-step payment form designed to
collect sensitive information such as billing addresses, contact details, and credit card data.
One notable feature of this attack was its use of a double entry skimming technique, which
deceived users into entering their payment details twice. The threat actors leveraged both newly
registered and older, defunct domains to host their malicious scripts, exploiting the reputation of
long-standing domains to evade detection.
Attack Methodology
1. Initial Infection:
a. The attack likely originated from vulnerable components in Magento or similar e-
commerce platforms.
b. A skimmer loader script, disguised as a third-party script loader, was embedded
on the homepage. This script was unobfuscated and dynamically added to the
webpage.
Stage 1 - loader
(Skimmer running on casio.co.uk)
2. Second-Stage Skimmer:
a. The second-stage skimmer employed multiple layers of obfuscation, including:
i. Custom encoding techniques to differentiate variables and strings across
victims.
ii. XOR-based string concealment to bypass static analyzers and web
application firewalls.
(Stage 2-Skimmer -)
3. Payment Flow Manipulation:
a. Unlike traditional skimmers, the attack targeted the cart page instead of the
checkout page.
b. Users who clicked the "Checkout" button on the cart page were redirected to a
fake payment form embedded in a pop-up window.
c. The form featured three steps:
i. Step 1: Collection of personal information (name, address, phone number,
etc.)
(process of the skimmer payment flow)
ii. Step 2: Display shipping details with a "Continue" button.
iii. Step 3: Collection of payment details (credit card number, expiration date,
CVV).
(Error displayed to the user after entering the details on the fake form)
d. After submission, the skimmer encrypted the data using AES-256-CBC and
exfiltrated it to a malicious server.
The payload contains several sensitive data, including:
• Billing Address
• Credit Card Name
• Credit Card Number
• Credit Card Expiration Date
• Credit Card CVV Code
• Phone Number
• Email Address
4. Evasion Techniques:
a. The skimmer avoided manifesting on the checkout page to evade detection by
security tools.
b. It used a sophisticated evasion mechanism to prevent its delivery under specific
conditions.
5. Indicators of Malicious Behavior:
a. Users were prompted to enter their details twice due to the altered payment flow.
b. The "Buy Now" button bypassed the fake form, as the skimming code was not
designed to handle that flow.
Indicators of Compromise (IoCs)
Domain IP Address ASN ASN Name Country
app[.]imagechat[.]net 82[.]202[.]163[.]201 AS29182 ru-jsciot RU
augmetrics[.]org 82[.]202[.]166[.]53 AS29182 ru-jsciot RU
conn[.]augmetrics[.]org 82[.]202[.]166[.]53 AS29182 ru-jsciot RU
img[.]tradewine[.]net 82[.]146[.]51[.]108 AS29182 ru-jsciot RU
static[.]easyanalytic[.]net 82[.]202[.]166[.]35 AS29182 ru-jsciot RU
www[.]augmetrics[.]org 82[.]202[.]166[.]53 AS29182 ru-jsciot RU
www[.]pagelook[.]org 82[.]202[.]165[.]30 AS29182 ru-jsciot RU
www[.]trade4host[.]com 82[.]202[.]163[.]72 AS29182 ru-jsciot RU
www[.]tradewine[.]net 82[.]146[.]51[.]108 AS29182 ru-jsciot RU
Recommendations
1. Implement Robust Content Security Policies (CSP):
a. Ensure CSPs are configured in blocking mode rather than report-only mode.
b. Include proper reporting directives (e.g., report-uri or report-to).
2. Regular Vulnerability Assessments:
a. Conduct periodic security audits on e-commerce platforms and update vulnerable
components promptly.
b. Utilize tools to monitor the integrity of third-party scripts.
3. Use Website Monitoring Solutions:
a. Deploy automated tools like Jscrambler’s Webpage Integrity to detect and prevent
web skimming attacks in real-time.
4. Educate Users:
a. Raise awareness among end users to recognize unusual payment flows and error
messages.
b. Encourage reporting of suspicious behavior on e-commerce websites.
5. Analyze Suspicious Domains:
a. Use tools to identify and block defunct domains potentially used by attackers.
Conclusion
The Casio.co.uk web skimming incident underscores the persistent threat posed by Magecart-
style attacks. While the attack leveraged a sloppy design and visible alterations to the payment
flow, it highlights the need for proactive security measures. Organizations must adopt robust
security policies, deploy advanced monitoring tools, and regularly assess their web applications
to mitigate such risks. By prioritizing client-side security, businesses can protect sensitive
customer data and maintain their reputation.
References
• Hackread.com - Counterfeit Branded Shoe Stores Hacked Web Skimmer
• Jscrambler Blog - Stealing Seconds: Web Skimmer Compromises Websites
• Stealing Seconds: Web Skimmer Compromises Casio UK
