Researchers detected a new Magecart attack across more than 200 online campus bookstores in the U.S. and Canada powered by the PrismWeb e-commerce platform.

Trend Micro first detected the attack on April 14 and named it Mirrorthief for its use of the Trojan.JS.MIRRORTHEIF.AA skimming script. Once injected into payment checkout pages, the script scrapes both credit card information and personal details and sends the data to a remote server.

Infection was made possible when attackers compromised the JavaScript libraries used by PrismWeb, which supports online book and merchandise stores across North America.

On April 26, PrismWeb released a statement that acknowledged the Trend Micro findings, vowed to launch a full investigation and promised to provide affected customers with “additional information and guidance,” but there’s no word on how many users or credit cards were compromised.

Magecart Uses a Custom Skimmer

Magecart has caused major problems for online retailers. As Bleeping Computer reported, malicious actors recently leveraged the web skimming script to attack popular OpenCart websites. Meanwhile, Help Net Security noted that more than 420,000 credit cards were compromised in 2018 after Magecart infected the e-commerce portals of British Airways and Ticketmaster.

Although the current campus store attack shares “some similar characteristics” of other threat actors, Trend Micro noted that the Mirrorthief group used a custom skimmer version to target PrismWeb. In addition, the encryption algorithm and JavaScript library differed from other popular groups such as Magecart Group 11 and ReactGet, suggesting a purpose-built attack rather than a reskinned version of more common vectors.

Using a forged Google Analytics script, the attackers compromised PrismWeb’s payment checkout libraries to collect data credit card numbers, expiry dates, card types, card verification numbers (CVNs) and cardholder names along with consumer addresses and phone numbers from completed payment forms. This information was then copied into JSON format, encrypted with Advanced Encryption Standard (AES) and base64 encoding and sent to a remote server via HTML image elements.

How to Curtail Campus Compromise

Attack surfaces are expanding faster than companies can keep up; targeted Magecart attacks on campus e-Commerce platforms are one example of niche vectors quickly becoming commonplace as cybercriminals gain access to more sophisticated tools.

To combat these emerging threats, security teams need the right mix of technology and talent. For example, automated and adaptive security systems can help security teams proactively identify problems, while partnerships with managed security services providers (MSSPs) can help them discover critical vulnerabilities and remediate network attacks.