Hackers Target Real Estate Websites with Skimmer in Latest Supply Chain Attack

Threat actors leveraged a cloud video hosting service to carry
out a supply chain attack on more than 100 real estate websites^[1] operated by Sotheby’s
Realty that involved injecting malicious skimmers to steal
sensitive personal information.

“The attacker injected the skimmer JavaScript codes into video,
so whenever others import the video, their websites get embedded
with skimmer codes as well,” Palo Alto Networks’ Unit 42
researchers said^[2]
in a report published this week.

The skimmer attacks, also called formjacking, relates to a type
of cyber attack wherein bad actors insert malicious JavaScript code
into the target website, most often to checkout or payment pages on
shopping and e-commerce portals, to harvest valuable information
such as credit card details entered by users.

In the latest incarnation of the Magecart attacks, the operators
behind the campaign breached the Brightcove account of Sotheby’s
and deployed malicious code into the player of the cloud video
platform by tampering with a script that can be uploaded to add
JavaScript customizations to the video player.

“The attacker altered the static script at its hosted location
by attaching skimmer code. Upon the next player update, the video
platform re-ingested the compromised file and served it along with
the impacted player,” the researchers said, adding it worked with
the video service and the real estate company to help remove the
malware.

The campaign is said to have begun as early as January 2021,
according to MalwareBytes^[3], with the harvested
information — names, emails, phone numbers, credit card data —
exfiltrated to a remote server “cdn-imgcloud[.]com” that also
functioned as a collection domain for a Magecart attack^[4]
targeting Amazon CloudFront CDN in June 2019.

To detect and prevent injection of malicious code into online
sites, it’s recommended to conduct web content integrity checks on
a periodic basis, not to mention safeguard accounts from takeover
attempts and watch out for potential social engineering
schemes.

“The skimmer itself is highly polymorphic, elusive and
continuously evolving,” the researchers said. “When combined with
cloud distribution platforms, the impact of a skimmer of this type
could be very large.”