Cybercriminals Leverage Google Tag Manager for Credit Card Data Theft

It is common for cybersecurity criminals to exploit vulnerabilities in Magento to inject an obfuscated script, which has been delivered through Google Tag Manager (GTM), into Magento-based eCommerce platforms, which allows them to intercept and steal credit card information during the checkout process.

Using a hidden PHP backdoor, unauthorized access can be enabled, and continuous data exfiltration can continue, allowing persistence to be maintained. 

A security researcher at Sucuri discovered that the credit card skimming malware was embedded in a database table called cms_block.content, which enables unauthorized access and continuous data exfiltration.

Because the malware is designed to avoid detection, it appears legitimate, and as a result, security measures may have a difficult time identifying and containing the threat. As a result, experts advise website administrators to implement enhanced security protocols so that such threats can be identified and eliminated efficiently. 

An investigation conducted by Sucuri recently revealed the presence of sophisticated credit card skimming operations that targeted a Magento-based eCommerce platform. To carry out the attack successfully, Google Tag Manager (GTM) is being used to inject malicious JavaScript into the checkout process to facilitate the collection of payment information without the user’s knowledge.

Throughout the cms_block, the malware was embedded to accomplish its purpose.&

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.