The Lucrative Business of Magecart
Magecart is a criminal website hacker group who are responsible for the theft of millions of credit card numbers through client-side website breaches of some of the largest e-commerce websites online. But why credit-card numbers? What are they actually valued at.
For this blog we should explore the various dark-web market places and highlight how much stolen credit-card numbers are sold for. Normally people don’t access the dark web so while this information is talked about, actually showing evidence of it and talking about it would be great information. Its great to show how numbers are sold in batches and ideally, if we can find some which are the result of a web-skimming breach, then this would be the icing on the cake.
Websites Are Currently Infected With Web-Skimming Malware
While the headlines often talk about the major brands that get breached by Magecart, there are thousands of existing small boutique websites that have active web-skimming malware capturing and stealing customer payment information — and customers are unaware of it.
So for this — if you look at some of the links being shared in the Magecart community (such as https://urlscan.io/result/d6cd089a-5785-40df-bb35-01637dd4a743/) — its possible to find a bunch of hacked sites with active malware. If you use tools like publicwww.com you can also find sites infected too — such as https://publicwww.com/websites/payprocessor.net/ — we should show some active examples and maybe break one of them down to show where the communications are going.
The Proliferation of Hacking Tools — Off The Shelf Data Theft
People often associate large-scale breaches as the works of technical masterminds with advanced computer skills, but this isn’t always the case. The dark web provides a marketplace of tools designed to allow someone from going to entry-level criminal to master web-skimming in minutes with readily available downloads for the cost of a few bitcoins.
So for this we should demonstrate (with real examples) how easy it is to obtain web-skimming software and why its so critical to protect against it. Have a look at the dark web market places and grab some screen captures of web-skimming software for sale, including the descriptions etc…
Write about what this tech does, and how you (as a criminal) would then make use of it to steal credit-card numbers.