Security News > 2020 > December > Credit card stealing malware hides in social media sharing icons
Newly discovered web skimming malware is capable of hiding in plain sight to inject payment card skimmer scripts into compromised online stores.
The malware's creators use malicious payloads concealed as social media buttons that mimic high profile platforms such as Facebook, Twitter, and Instagram.
The payment skimmer malware pulls its sleight of hand trick with the help of a double payload structure where the source code of the skimmer script that steals customers' credit cards will be concealed in a social sharing icon loaded as an HTML 'svg' element with a 'path' element as a container.
The syntax for hiding the skimmer's source code as a social media button perfectly mimics an 'svg' element named using social media platform names.
This tactic increases the chances of avoiding detection even if one of the two malware components is found since the malware loader is not necessarily stored within the same location as the skimmer payload and their true purpose might evade superficial analysis.