Threat actors used a cloud-based video hosting service to perform a supply chain attack on more than 100 real estate websites operated by Sotheby’s Realty that involved the injection of malicious skimmers to steal sensitive personal information .
“Others import videos, even their websites are embedded with skimmer codes,” researchers from Unit 42 at Palo Alto Networks said in a report released this week.
« The attacker modified the static script in his hosted location by attaching the skimmer code. On the next player update, the video platform reingested the compromised file and served it with the affected player. » the researchers said, adding that he had worked with the video service and the real estate company to help remove the malware.
The campaign is said to have begun as early as January 2021, according to MalwareBytes, with the harvested information — names, emails, phone numbers, credit card data — exfiltrated to a remote server « cdn-imgcloud[.]com » that also functioned as a collection domain for a Magecart Attack targeting Amazon CloudFront CDN in June 2019.
To detect and prevent the injection of malicious code into online sites, it is recommended that you perform periodic web content integrity checks, remembering to protect accounts from takeover attempts and pay attention to potential social engineering schemes.
“The skimmer itself is highly polymorphic, elusive and ever-changing,” the researchers said. “When combined with cloud distribution platforms, the impact of such a skimmer could be very significant.