Source Defense Research
@sdcyberresearch
Followers
224
Following
11
Media
146
Statuses
204
A cybersecurity company specializing in web application security, protecting against supply chain attacks and client-side vulnerabilities
Joined October 2023
Over 60 UK fast food websites are under #magecart attack .A malicious WebSocket connects to clearnetfab[.]net (CosmicSting). Sites share the same developer. Infected script: /Global_Theme/js/flickity.pkgd.min.js.#webskimming #FormJacking #PCIDSS
0
2
6
SD research found a new Google Tag Manager calls to the known #magecart domain jqueri[.]at.id=GTM-M8RCKDCJ.#webskimming #FormJacking #PCIDSS
0
0
4
1
0
5
🚨New #magecart attack detected:.1st-party code initiates a WebSocket connection to clicktrack01.\com. Magecart JavaScript is delivered via an incoming message, harvesting #payment data and sending it through a second WebSocket to jartrack01.\com.#webskimming #FormJacking #PCIDSS.
0
0
2
The same attack method, the same Google Tag Manager IDs. But another domain. The same #magecart attack now uses the domain fastcdnjs.\com.Follow the colors 🖌️.Found active on more than 20 #ecommerce websites worldwide.#webskimming #FormJacking #PCIDSS
0
1
2
A new Google Tag Manager was found that loads the known #magecart domain cloudflare-js5[.]com.id=GTM-N7LJ8P68.#webskimming #FormJacking #PCIDSS
0
0
1
#magecart alert.SD research has uncovered a malicious JS embedded inside the Google Tag Manager container code itself, not merely loaded through it as is typically seen. GTM-MJ2PF98H.#Payment data is sent to the known malicious domain seomgr./com.#webskimming #FormJacking #PCIDSS
0
0
2
A double entry #magecart attack from the domain gistatics.\com using webSocket, fakes the @Stripe payment page and steals the #payment data.#webskimming #FormJacking #PCIDSS
0
0
3
A double entry #magecart attack from a 1st party script, fakes the #payment form, and sends the data twice:.1⃣to the malicious domain magentoplugins.\cc.2⃣to apparently legit domain eshop.instalace-tzb.\cz.Found on more than 1k #ecommerce websites worldwide. #webskimming #PCIDSS
0
0
2
A #magecart silent skimmer now operates via Google Tag Manager id=GTM-5N25X3FQ. The malicious domain: cloudflare-js5.\com.Same method as its IP brothers static5-jquery\.com & static6-jquery.\com.Stolen #payment data is sent to data1-jquery.\com.#webskimming #FormJacking #PCIDSS
0
0
2
#magecart domain alert❗️.A silent skimming attack load from scripts.peachseo\.com/services/editor-elements-library/dist/thunderbolt/rb_wixui.a240ce2a.bundle.min.js.sends the #payment data to the known malicious domain csp.safecontentdelivery\.com.#webskimming #FormJacking #PCIDSS.
0
0
1
SD research found a new Google Tag Manager that loads the known #magecart domain jqueri[.]at.id=GTM-TVH955B8.#webskimming #DataSecurity #FormJacking #PCIDSS
0
0
2
17❗️ Google Tag Managers initially linked to #magecart domain gstatis\.co are now calling jqueri\.at. IDs:.NDBZP4W9.T93CNFFV.WJC24WKC.MVRKVG5F.TCCZP6LC.5VV5ZFS6.NWZQS5QC.5N3X6KD9.KNZTJZ6G.P8FMRH5X.K9BJ4ZLG.5SM7XMJP.N8KJJZWW.5TX4GBHL.P4X2ZPCH.MCPLRRJ4.NKBWLJ4C.#webskimming #PCIDSS
0
3
6
The #magecart domain sentrymap\.us steal the payment data and send it to the legit @Google storage service #webskimming #DataSecurity #FormJacking #PCIDSS
0
0
4
A #magecart attack from the domain.css.telechargent/.com uses 2 methods:.1. Silent skimming attack by running a JS function on an image event.2. Double entry attack like the attack we posted here: #ecommerce #cybersecurity #webskimming #FormJacking #PCIDSS
Source Defense Research discovered a UK luxury furniture & home decor site under attack — using a similar method to the one first reported by @Jscrambler in February. The threat is evolving. We're watching closely. #ecommerce #cybersecurity #webskimming #FormJacking #PCIDSS
0
2
6
A stealthy #Magecart attack abuses broken images & dynamic decoding to hide payloads. Malicious JS connects to WebSocket servers like dcmplugins\.com, streams live code, and evades detection. Modular, real-time, and deadly. #webskimming #DataSecurity #FormJacking #PCIDSS
1
0
3
0
0
0
SD research found a new Google Tag Manager that loads the known #magecart domain gstatis[.]co.id=GTM-NKBWLJ4C.#webskimming #DataSecurity #FormJacking #PCIDSS
2
3
4
A double-entry #magecart attack using a 1st party script only. The local path media/cmp is used for storing the stolen #payment data and to return the magecart JS, which is stored in the local storage. Perfect faking Stripe's payment page. #WebSkimming #FormJacking #PCIDSS
0
0
2
A new #magecart attack abuses Google Tag Manager:.NSTTR9L → KX36TXD → KTZLSGSS & W33KS5VH. One loads a fake CSS from the goljsdofma/.org, hiding JS, and the other executes it and opens a WebSocket to goljsdofma/.org. It's complicated🤯, follow the colors🖌️. #PCIDSS #webskimming
2
8
8