30
The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More
Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.
Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.
24
Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Roundup: expired Visa cards can be revived for contactless payments via NFC relay; plus Apple spyware warnings and Ukraine cyberattacks on Russian e-commerce.
WIRED's weekly security roundup leads with research showing expired Visa contactless cards can be revived to make new payments through an NFC man-in-the-middle attack that alters the card's expiration date. The roundup also covers Apple sending an unprecedented volume of spyware warnings to users and Ukrainian cyber and drone attacks against a major Russian e-commerce company.
45
55
30
Trends in Web Threats: Attackers Were More Active During Holiday Season
Unit 42 tracked 533,000 malicious landing URL incidents from October-December 2021, showing web threats peaked during the holiday shopping season.
Unit 42 detected 533,452 malicious landing URL incidents (120,753 unique) and 2,906,875 malicious host URL incidents (165,255 unique) from October through December 2021. Threat activity peaked in November, likely tied to Black Friday in the United States, United Kingdom, and Germany. Most malicious domains appeared to originate in the United States, followed by Russia and Germany. Personal sites, blogs, business sites, and shopping sites were the most common apparently benign entry points for attacks.
15
30
42
30