Categories: Ad Guardian PlusNews

Skimming attack with phishing techniques

A new digital skimming attack borrows phishing techniques and steals card data from fake payments page. Attackers used the secure payment pages, from third-party payment service providers, and inserted digital skimming code. They used fake Google Analytics library (ga.js), according to Malwarebytes.

Director of threat intelligence, Jérôme Segura, discovered a fake payment-mastercard[.]com domain. This was “hosting a completely different kind of skimmer that at first resembled a phishing site.”

This skimmer is interesting because it looks like a phishing page copied from an official template for CommWeb, a payments acceptance service offered by Australia’s Commonwealth Bank,” he explained. “The attackers have crafted it specifically for an Australian store running the PrestaShop Content Management System (CMS), exploiting the fact that it accepts payments via the Commonwealth Bank.”

Moreover, the fake payments page even alerts users if any fields they fill in are invalid.

After steeling victim’s details, they land on the real payment processor. The real Australian Commonwealth Bank site displayed along with the correct total amount due for purchase. This is possible by creating a unique session ID and reading browser cookies, Segura explained.

Externalizing payments shifts the burden and risk to the payment company such that even if a merchant site were hacked, online shoppers would be redirected to a different site (i.e. Paypal, MasterCard, Visa gateways) where they could enter their payment details securely,” he concluded.

Unfortunately, fraudsters are becoming incredibly creative in order to defeat those security defenses. By combining phishing-like techniques and inserting themselves in the middle, they can fool everyone.”

How the skimming attack works

The skimming attack is, thus, more dangerous than the previous ones. Here is the method it uses:  

  • The fake page collects the credit card data filled in by the victim. Then, it steals the data via the payment-mastercard rcard[.]com/ga.php?analytic={based64} URL.
  • Afterwards, the victim lands on the real payment processor.
  • In the end, the legitimate site for Australia’s Commonwealth Bank loads and displays the total amount due for the purchase.
Laurentiu Titei

View Comments

Recent Posts

Toshiba Universal Printer 2 Driver Download for Windows System

Toshiba Universal Printer 2 driver is a single, versatile driver that supports a network of…

1 day ago

Best Ways to Download Linksys AE1200 Driver

The Linksys AE1200 is a network adapter well-known for its easy setup, strong signal, and…

2 days ago

How to Download BCM20702A0 Driver and Install in Windows 11/10

Ever wondered how Bluetooth components interact with your computer?  This is because communication is made…

3 days ago

Best Free PC Games Download Sites (Latest 2025)

Tired from your studies, office job, or any other hectic task? Then, you can turn…

4 days ago

Lexmark Drivers Download for Windows System

Lexmark, now a part of Xerox, has built a reputation for good, reliable, durable, and…

5 days ago

How to Update Windows Security Signatures Manually Windows 11/10

Windows Security signatures are digital fingerprints that verify the integrity and authenticity of various software…

5 days ago