Yet Another Twist to Credit Card Phishing

(The following is reposted from www.securityweek.com.  You can read the original posting here.) 

According to Daniel Cid, Chief Technology Officer at Sucuri, phishers are breaking into e-commerce web sites and surreptitiously planting code to redirect sensitive payment details to third-party domains.

"The attackers modify the flow of the payment process so that instead of just processing the card, they redirect all payment details to a domain they own so they can steal the card details," Cid explained in a blog post.

The trick involves very stealthy, minimal changes to the hacked site. This is done to ensure persistence and to stay undetected for as long as possible. 

In one example, Cid showed how a credit card processing file on a hacked e-commerce site was modified to either transmit the credit card data via e-mail or redirect the data flow to a new domain.

The third-party domain receiving the stolen data looks almost like the payment handling site (slightly misspelled to avoid detection). 

"This redirection forces all the transaction data, including credit card details (name, address, CC and CVV), through their malicious server, in turn allowing the data to be stolen by the bad guys," Cid explained.

Interestingly, the data redirection does not affect the actual credit card transaction. Instead, the phishers are basically siphoning all the confidential data during the transaction process, quietly stealing credit card data without triggering alarm bells.