Javascript sniffers have grown into one of the most dreaded threats for eCommerce businesses over the past five years. The uncomplicated nature of such kinds of attacks coupled with the use of rogue JavaScript code towards the interception of details regarding during payment, entice more and more hackers, as well as JS sniffers, went on to become one of the most leading sources of stolen bank cards on the various underground market. In one campaign that took place recently, a huge step forward in cyberattacks on e-commerce websites that involves JS-sniffers has been seen.

An article has been published by Sansec, in July 2020, regarding the attacks on the US and European online shops with the help of JavaScript sniffers (JS-Sniffers). The researchers have attributed the “clientToken=” campaign to the North Korean APT named Lazarus (aka Dark Seoul Gang, HIDDEN COBRA, Guardians of Peace, APT38, APT-C-26, Labyrinth Chollima, Zinc, Bluenoroff, Stardust Chollima).

These campaigns have been looked into by the Group-IB Threat Intelligence team, and he identified a separate campaign that involves the same infrastructure. The hacker returned to the old style of pilfering crypto with the help of a tool that has never been used before. Lazarus has attacked online stores that accept payments through the mode of cryptocurrency using crypto skimmers.

Initial Discovery

In May 2019, the clientToken= campaign launched by Lazarus and identified by Sansec began. During this particular campaign, the hackers made use of a list of breached websites for hosting rogue JavaScript files to steal bank card details from the US and European online shoppers.

• stefanoturco[.]com
• technokain[.]com
• darvishkhan[.]net
• areac-agr[.]com
• luxmodelagency[.]com
• signedbooksandcollectibles[.]com

Infected Websites

Three breached websites have been detected, while analysis was conducted on Lazarus BTC Changer. Two of these websites were even present in the list of Sansec’s articles as victims of the clientToken= campaign: “Realchems” (https://realchems.com/) and “Wongs Jewellers” (https://www.wongsjewellers.co.uk/).