Skip to main content

Hackers Target Real estate websites with skimmer in latest supply chain attack



Threat actors used a cloud-based video hosting service to perform a supply chain attack on more than 100 real estate websites operated by Sotheby's Realty that involved the injection of malicious skimmers to steal sensitive personal information . 

“Others import videos, even their websites are embedded with skimmer codes,” researchers from Unit 42 at Palo Alto Networks said in a report released this week.

The skimmer attacks, also called formjacking, relates to a type of cyber attack wherein bad actors insert malicious JavaScript code into the target website, most often to checkout or payment pages on shopping and e-commerce portals, to harvest valuable information such as credit card details entered by users.


In the latest incarnation of the Magecart attacks, the operators behind the campaign hacked Sotheby's Brightcove account  and deployed malicious code in the cloud video platform player by forging a script that can be loaded to add JavaScript customizations to the video player. 

"The attacker modified the static script in his hosted location by attaching the skimmer code. On the next player update, the video platform reingested the compromised file and served it  with the affected player." the researchers said, adding that he had worked with the video service and the real estate company to help remove the malware.

The campaign is said to have begun as early as January 2021, according to MalwareBytes, with the harvested information — names, emails, phone numbers, credit card data — exfiltrated to a remote server "cdn-imgcloud[.]com" that also functioned as a collection domain for a Magecart Attack  targeting Amazon CloudFront CDN in June 2019.

To detect and prevent the injection of malicious code into online sites, it is recommended that you perform periodic web content integrity checks, remembering to protect accounts from takeover attempts and pay attention to potential social engineering schemes. 

“The skimmer itself is highly polymorphic, elusive and ever-changing,” the researchers said. “When combined with cloud distribution platforms, the impact of such a skimmer  could be very significant.



source https://techncruncher.blogspot.com/2022/01/hackers-target-real-estate-websites.html

Comments

Post a Comment

Popular posts from this blog

The Silent Revolution of On-Device AI: Why the Cloud Is No Longer King

Introduction For years, artificial intelligence has meant one thing: the cloud. Whether you’re asking ChatGPT a question, editing a photo with AI tools, or getting recommendations on Netflix — those decisions happen on distant servers, not your device. But that’s changing. Thanks to major advances in silicon, model compression, and memory architecture, AI is quietly migrating from giant data centres to the palm of your hand. Your phone, your laptop, your smartwatch — all are becoming AI engines in their own right. It’s a shift that redefines not just how AI works, but who controls it, how private it is, and what it can do for you. This article explores the rise of on-device AI — how it works, why it matters, and why the cloud’s days as the centre of the AI universe might be numbered. What Is On-Device AI? On-device AI refers to machine learning models that run locally on your smartphone, tablet, laptop, or edge device — without needing constant access to the cloud. In practi...
1 comment
Read more

Apple’s AI Push: Everything We Know About Apple Intelligence So Far

Apple’s WWDC 2025 confirmed what many suspected: Apple is finally making a serious leap into artificial intelligence. Dubbed “Apple Intelligence,” the suite of AI-powered tools, enhancements, and integrations marks the company’s biggest software evolution in a decade. But unlike competitors racing to plug AI into everything, Apple is taking a slower, more deliberate approach — one rooted in privacy, on-device processing, and ecosystem synergy. If you’re wondering what Apple Intelligence actually is, how it works, and what it means for your iPhone, iPad, or Mac, you’re in the right place. This article breaks it all down.   What Is Apple Intelligence? Let’s get the terminology clear first. Apple Intelligence isn’t a product — it’s a platform. It’s not just a chatbot. It’s a system-wide integration of generative AI, machine learning, and personal context awareness, embedded across Apple’s OS platforms. Think of it as a foundational AI layer stitched into iOS 18, iPadOS 18, and m...
Post a Comment
Read more

Billionaire clothing dynasty heiress launches Everybody & Everyone to make fashion sustainable

Veronica Chou’s family has made its fortune at the forefront of the fast fashion business through investments in companies like Michael Kors and Tommy Hilfiger . But now, the heiress to an estimated $2.1 billion fortune is launching her own company, Everybody & Everyone , to prove that the fashion industry can be both environmentally sustainable and profitable. There’s no argument about the negative impacts of the fashion industry on the environment. The textiles industry primarily uses non-renewable resources — on the order of 98 million tons per year. That includes the oil to make synthetic fibers, fertilizers to grow cotton, and toxic chemicals to dye, treat, and produce the textiles used to make clothes. The greenhouse gas footprint from textiles production was roughly 1.2 billion tons of CO2 equivalent in 2015 — more than all international flights and maritime shipments combined (and a lot of those maritime shipments and international flights were hauling clothes). The lit...
Post a Comment
Read more