Payment scammers hit 201 campus checkouts with Magecart

Mirrorthief is a new group that specifically targeted an orgnization that provides code to colleges and universities.

A gang of payment-card scammers has targeted 201 college and university campus stores, trying to steal students’ financial data in a Magecart-style attack, according to new research.

The new cybercrime group, labeled Mirrorthief, injected malicious code on payment checkout pages at hundreds of U.S. and Canadian stores, according to TrendMicro research published Friday. By compromising PrismWeb, an e-commerce platform designed for college stores, the attackers could collect payment card details, names, addresses and phone numbers, researchers said. PrismWeb is made by PrismRBS, a subsidiary of the Nebraska Book Company.

TrendMicro’s report comes as security researchers continue to grapple with an expansion of payment-card thievery along with an apparent surge in demand for stolen financial information. Success by one group inspires imitators in another. The most prominent, Magecart, is a collection of perhaps 12 hacking campaigns that steal payment information by secretly collecting data from online checkout pages.

TrendMicro researchers noted that Mirrorthief is not another Magecart group, though the attack techniques share similar strategies.

Mirrorthief is successful in part because it registers its malicious web domains in a way that disguises their true intent, and it also impersonates the Google Analytics service to skim information, as Magecart did in its breach of optical equipment manufacturer Vision Direct. But this attack specifically targeted PrismRBS technology, unlike other payment thieves who design their code to steal information from as many pages as possible.

“When we checked Mirrorthief’s network infrastructure, we found that it did not have any overlap with any known cybercrime groups,” the researchers said.

The number of people affected was not immediately clear. TrendMicro detected its first attack against “multiple stores” on April 14. PrismRBS said it learned of the breach on April 26, and that it too immediate steps to halt the attack.

Magecart methods have ranged from breaching sites via third-party providers, such as customer service tools, to harvesting data with JavaScript-sniffers, which allow thieves to steal financial data with just a few lines of code. Thousands of companies have been hit by Magecart, including British Airways, BevMo and OXO, the housewares giant.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure