Threat Actors Deploy Malware on E-commerce Servers

Share post:

The Sansec Threat Research Team recently uncovered a malicious activity in which threat actors infiltrate credit card skimmers into the websites of online stores to deploy Linux malware on compromised e-commerce servers.

The attackers use a PHP-encoded web skimmer to download and infiltrate fake payment forms on the checkout pages, which are displayed to customers through the hacked online store.

Other discoveries by the security company include the malware receiving commands from a Beijing server hosted on Alibaba’s network, and achieving persistence by adding a new crontab entry that fulfills two main tasks: downloading the malicious payload from its command-and-control server and reinstalling the back door if it is detected.

As soon as the malware is started, it immediately removes itself from the disk and disguises itself as “ps _ ef.” This is used to get a list of currently running processes.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs



Related articles

Kaspersky uncovers malware targeting iPhones running iOS 15.7 and below

Kaspersky has uncovered a sophisticated malware campaign specifically designed to infect iPhones running up to iOS 15.7 through...

WordPress fixes critical Jetpack plugin vulnerability

WordPress has addressed a critical flaw discovered in the Jetpack plugin, which had the potential to enable authors...

Akamai discovers Dark Frost botnet exploiting gaming platforms

Akamai's security intelligence response team recently has alerted the general public of Dark Frost, a botnet that has...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways