The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More
Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.
Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.
- 2.24 million web threat incidents and 831,550 unique URLs analyzed over 12 months.
- Activity peaked October 2020-January 2021, aligned with holiday shopping.
- Top five threat classes: coinminers, JS downloaders, web skimmers, web scams, JS redirectors.
- 684,276 unique malicious JavaScript snippets grouped into 18 tracked families.
- Web skimmers increasingly hosted on cloud platforms to evade detection.
- Vendors
- Palo Alto Networks
- Products
- Advanced URL Filtering
- Malware
- web skimmers
- Organizations
- Unit 42
- Countries
- United StatesRussiaGermany
From the original article
8 min read at unit42.paloaltonetworks.com
It’s no secret that web threats, fueled by sophisticated attackers, continue to increase and do more damage. As part of our regular tracking and observation of trends in web threats, from October 2020 to September 2021, our web threat detection module found around 2,240,000 incidents of malicious landing URLs containing all kinds of web threats, 831,000 of which are unique URLs.
By Tao Yan, Taojie Wang, Jin Chen, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.