Security News > 2022 > January > Hackers Target Real Estate Websites with Skimmer in Latest Supply Chain Attack

Threat actors leveraged a cloud video hosting service to carry out a supply chain attack on more than 100 real estate websites operated by Sotheby's Realty that involved injecting malicious skimmers to steal sensitive personal information.

"The attacker injected the skimmer JavaScript codes into video, so whenever others import the video, their websites get embedded with skimmer codes as well," Palo Alto Networks' Unit 42 researchers said in a report published this week.

The skimmer attacks, also called formjacking, relates to a type of cyber attack wherein bad actors insert malicious JavaScript code into the target website, most often to checkout or payment pages on shopping and e-commerce portals, to harvest valuable information such as credit card details entered by users.

In the latest incarnation of the Magecart attacks, the operators behind the campaign breached the Brightcove account of Sotheby's and deployed malicious code into the player of the cloud video platform by tampering with a script that can be uploaded to add JavaScript customizations to the video player.

"The attacker altered the static script at its hosted location by attaching skimmer code. Upon the next player update, the video platform re-ingested the compromised file and served it along with the impacted player," the researchers said, adding it worked with the video service and the real estate company to help remove the malware.

"The skimmer itself is highly polymorphic, elusive and continuously evolving," the researchers said.

News URL

https://thehackernews.com/2022/01/hackers-target-real-estate-websites.html