Magecart threat actors have switched most of their operations server-side to avoid detection of security firms. However, Malwarebytes researchers warn that the Client-side Magecart attacks are still targeting organizations, but are more covert.
The researchers recently uncovered two domains, “scanalytic[.]org” and “js.staticounter[.]net,” belonging to the Magecart infrastructure on the same ASN (AS29182) that was used by the cybercriminals.
Malwarebytes linked the 2 domains with a previous campaign from November 2021 which was characterized by the first use of a software skimmer designed to check the execution within a virtual machine.
The experts also noticed that the threat actors have now removed the VM detection code, perhaps because it caused more issues than benefits.
The discovery of additional domains linked to the same infrastructure suggests the campaign dates back to at least May 2020.
The researchers explained that they have generally seen less skimming attacks during the past several months, perhaps because they were more focused on the Magento CMS.
(SecurityAffairs – hacking, Magecart)