Double-dipping scammers don't need malware to grab card numbers and turn a profit, report says

A China-based e-commerce scam appears to be harvesting payment information not through direct hacks on companies or using pernicious malware to skim data, but with a simpler approach.

Stolen credit card numbers sometimes spill onto the dark web for the most mundane reason: People carelessly give them up.

According to researchers with Gemini Advisory, a China-based e-commerce scam appears to be harvesting payment information not through direct hacks on companies or using pernicious malware to skim data, but with a simpler approach. The fraudsters set up hundreds of websites that appear to sell legitimate goods, but instead capture card numbers for sale on the dark web, Gemini says.

It ends up being a double-dip for the crooks: In addition to vending the card data and other information about shoppers in cybercriminal forums, they also collect money for items that are “faulty, counterfeit, or nonexistent,” Gemini says in a report published Thursday. The dark web sales have led to profits upwards of $500,000 over the past six months, but the total take is “likely significantly larger,” considering all the money the scammers probably collected for the bogus goods.

Tens of thousands of payment records from the U.S. and elsewhere have been exposed, Gemini says. The report comes as the coronavirus pandemic has upended retail experiences for much of the world, and U.S. and European consumers are entering into a holiday shopping season that will more online than ever. It’s also a reminder that while Magecart malware and other payment information skimmers get a lot of attention from cybersecurity researchers, there’s more than one way to pilfer a credit card number.

An operation like this takes some infrastructure, of course. To appear as legitimate merchants while hiding their connections to the larger scam, each of the sites needs a unique merchant name and merchant identification number (MID). Getting an MID “requires either a direct partnership with an acquiring bank or a relationship with a third-party merchant company that works with a dedicated acquiring bank,” Gemini notes, adding that “nearly 200 of the scam sites from the identified group were linked to the Chinese acquiring bank Jilin Jiutai Rural Commercial Bank Co., Ltd.”

Gemini doesn’t link the bank directly to the scam — it’s possible the relationship was managed through third-party companies.

Gemini says there are about 600 associated web addresses, and most of them are registered through China’s ename.net. The fake stores generally use the e-commerce platform OpenCart, because it’s open source — as opposed to a platform like Shopify, which has fraud monitoring and mitigation policies in place. The group also relies on web infrastructure from Cloudflare “to hide its IP addresses for all of its sites,” the report says.

“This cookie-cutter approach was likely taken to facilitate the rapid deployment of a large number of scam sites,” Gemini says.

The fraudsters also have other techniques to lure people in and appear legitimate.

“For the average customer, there is no visible link between the different sites within the network as each appears to be a distinct, legitimate shop,” Gemini says. “The sites use Google Ads and social media advertisement campaigns to attract customers with offers for products at a discount below market deals. The sites’ advertisements almost always indicate that the deals are part of a limited-time sale to pressure potential customers into making a purchase.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure