FAKE GIF LEVERAGED IN MULTI-STAGE REVERSE-PROXY CARD SKIMMING ATTACK

Summary from the TLDR InfoSec newsletter

This blog post examines a sophisticated card-stealing malware that exploited a vulnerability in an outdated Magento eCommerce site. The first stage of the malware injects obfuscated JS onto every page that loads a PHP script, which masquerades as a GIF and sets up a reverse proxy to intercept all requests before modifying the responses to hide its activity and planting a trigger in the user's User Agent. A second tampered file, onestepcheckout[.]phtml, loads the payload out of the User Agent into sessionStorage, and if the trigger is detected, the onestepcheckout injection detonates on the checkout page.