Magecart client-side attacks are still active but appear more covert, with researchers tracing new anti-VM infrastructure and noting visibility risks if operators move to server-side skrimming. The investigation links two newly reported anti-VM skimmer domains to a broader campaign and highlights how input-field naming and evolving infrastructure help attackers evade detection.
Keypoints
- Magecart client-side attacks persist, and visibility can drop if operations shift server-side, making cleanup and detection more challenging.
- New anti-VM skimmer domains (js.staticounter.net and scanalytic.org) are linked by ASN AS29182, and both shed VM-detection code in newer samples.
- Important input field names have shifted from explicit labels (e.g., CcNumber) to generic web terms, reducing obvious data capture signals.
- urlscan.io-based investigation reveals extensive infrastructure (hostnames and IPs) tied to the campaign, and sandbox detection may explain incomplete sandbox data.
- Attack activity can be validated by replaying with real IPs to demonstrate malicious behavior beyond crawler results.
- There is a historical link to prior skimmer activity dating back to May 2020, suggesting a continued, interconnected campaign.
- Overall skimming appears to be less active recently, with WordPress/WooCommerce seeing more attacks than Magento; client-side visibility limits understanding of server-side activity.
MITRE Techniques
- [T1497] Virtualization/Sandbox Evasion – The skimmer checks for the use of virtual machines. “the first instance to our knowledge of a skimmer checking for the use of virtual machines.”
- [T1059.007] Command and Scripting Interpreter: JavaScript – The skimmer operates in the browser via JavaScript, with themes named after JavaScript libraries to conceal its code. “three different themes used by the threat actor to hide their skimmer, named after JavaScript libraries.”
Indicators of Compromise
- Hostnames – app.nomalert.org, static.clarlity.com, and 2 more
- IPs – 185.253.32.64, 185.253.33.191, and 2 more
- Skimmer Domains – abtasty.net, accdn.lpsnmedia.org, and 2 more