Hackers use video player to steal credit cards from over 100 sites

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/hackers-use-video-player-to-steal-credit-cards-from-over-100-sites/

Hackers used a cloud video hosting service to perform a supply chain attack on over one hundred real estate sites that injected malicious scripts to steal information inputted in website forms.

These scripts are known as skimmers or formjackers and are commonly injected into hacked websites to steal sensitive information entered into forms. Skimmers are commonly used on checkout pages for online stores to steal payment information.

In a new supply chain attack discovered by Palo Alto Networks Unit42, threat actors abused a cloud video hosting feature to inject skimmer code into a video player. When a website embeds that player, it embeds the malicious script, causing the site to become infected.

In total, Unit42 found over 100 real estate sites compromised by this campaign, showing a very successful supply chain attack.

The researchers notified the cloud video platform and helped the infected sites clear their pages, but this campaign is an example of the ingenuity and determination of adversaries.

 

[show-Zi]

I pray that sites such as x ... and Por .... will not be targeted.

 

[show-Zi]

I believe that the greatest vulnerabilities for humans derive from desire. Article-like traps can lead to an explosive increase in victims, depending on where they are set up.

Spoiler: P.S.

Now is the time to use spoilers for images

 

[Gandalf_The_Grey]

Update:
Card-stealing code found on more than 100 Sotheby’s luxury real estate sites

Threat actors have breached the Brightcove account of Sotheby’s and deployed code capable of stealing and collecting payment card details on more than 100 websites operated by Sotheby’s real estate division.

The attack was carried out via the Brightcove video player, which Sotheby’s was using to show previews of expensive real estate properties it was selling on its websites.

Attackers gained access to this account, which allowed them to append additional code to Sotheby’s custom Brightcove video player, code that was designed to hijack web forms and insert a keylogger.

The incident took place last year but was only disclosed on Monday in a report from security firm Palo Alto Networks.

Malwarebytes and other security researchers queried today by The Record are currently looking into this threat actor and the possibility that they might have breached other Brightcove customer accounts to attack other websites, including ones with actual e-commerce capabilities where payment card details are collected on a more frequent basis.

Card-stealing code found on more than 100 Sotheby's luxury real estate sites

Threat actors have breached the Brightcove account of Sotheby\'s and deployed code capable of stealing and collecting payment card details on more than 100 websites operated by Sotheby\'s real estate division.

therecord.media