Magecart strikes again, this time at electronics retailer Newegg

Researchers say the hacking group is getting better at finding ways to leverage faults in Javascript to hide and carry out breaches of credit card payment systems.

Code has been discovered siphoning credit card numbers from consumer technology retail website Newegg, according to security researchers from two cybersecurity companies.

In reports published Wednesday by RiskIQ and Volexity, researchers discovered instances of code liked to the operators of Magecart, a group that has been behind a slew of recent, high-profile credit card number breaches.

Thieves have been siphoning credit card data since Aug. 14, when a piece of Javascript was inserted into Newegg’s payment sites. That code pulled credit card numbers and sent them to a site with a similar URL — neweggstats[.]com. According to Volexity, the code wasn’t removed from the Newegg payment site until Tuesday.

Newegg is an extremely popular retailer, ranking 161 on Alexa’s list of top websites in the U.S. According to SimilarWeb, the site receives 50 million visitors a month.

“Over an entire month of skimming, we can assume this attack claimed a massive number of victims,” a blog from RiskIQ read.

Magecart has been behind a number of recent breaches, including ones targeting British Airways’ website and mobile app and a third-party customer service chat application used on Ticketmaster’s UK website.

Volexity writes that the Newegg attack shows that Magecart is refining its practices, getting better at ways to leverage faults in Javascript to hide and carry out crimes.

“This type of refinement is sure to continue as new organizations are targeted,” a blog post from Volexity’s research team reads. “While Magecart may be a major threat which eCommerce companies need to protect against, the larger issue is the increasing use of JavaScript-based data theft frameworks. … With minimal setup or knowledge required, these attacks will surely increase as time goes on.”

Newegg did not respond for comment.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure