Skimming typically involves attackers injecting unauthorized code into checkout and wallet pages. The script, in this case, was a heavily adapted Magecart skimmer that slotted in perfectly with the company’s customer relationship and checkout processes, which was surprising to analysts. Regular Magecart attacks carried out by more than a dozen groups are not usually so customized, but this one was adapted to the point where it wouldn’t work on any other website!

Rather than using supply chain attacks to implant the code, the attackers accessed Macy’s web server, modifying a JavaScript file called ClientSideErrorLog.js., probably because it was loaded on both the customer wallet and the Macys.com checkout page.

A Broader Attack

Web skimmers have previously targeted a single page (such as checkouts where shoppers enter their payment details) to lower the chance of discovery. However, this has also made it easier for security professionals to monitor one place for malicious code.

But on this occasion, the attackers chose to exploit every opportunity they could find, including a page called the wallet, where shoppers can save cards for quicker checkouts in the future.

Card numbers are usually masked with asterisks on these pages, but the Macy’s Magecart skimmer got around this by compromising the wallet functions used to handle payment cards. This approach has been a devastating innovation for skimming customer data.

New Account Credentials Targeted

Like many other retailers, Macy’s lets website visitors shop without an account, but it still encourages them (by offering 25% off) to turn the info they just entered into an account. The Macy’s Magecart attackers saw this as another opportunity for their skimmer to harvest data, so they attacked this vulnerability too. So meticulous were they that their malicious script works differently for guests and registered users.

Attention to Detail

The domain name and server where the skimmer sent the stolen data were up on September 24. The malicious script was injected into Macys.com on October 7 and was taken down by the company’s security team on October 15 after it noticed potentially malicious traffic.

The domain name used for data collection resembled a trusted third-party service used by Macy’s website so it would be almost indistinguishable from regular traffic. The script encoded the stolen information several times and then sent it to the Macy’s Magecart attackers’ servers so traffic analysis systems would struggle to spot it. The skimmer also marked the data according to where it had been stolen—the wallet page, guest checkout, or a registered user.

What Can You Do?

In this case, the takeaway message was that bad actors could exploit website design and operations processes that did not pay sufficient attention to unauthorized or insecure third-party code. But Reflectiz offers strong security that helps you quickly spot weak authentication, misconfigurations, and data leakage or exposure from third-party assets you control, even when these problems don’t come from within your network. You can configure a defense posture that suits your business situation. When any action diverges from that norm, you will receive an immediate alert about the risk, which will be blocked.

A platform like Reflectiz is sophisticated enough to ensure consumer privacy and safeguard data on both the server and client sides to keep you one step ahead of ever more sophisticated online attacks.

Securing Your Online Presence

Keep your online businesses safe by mitigating security and privacy risks resulting from next generation third-party threats on your website, without adding a single line of code.

Free Reflectiz Information Kit

Get first-hand information and use cases to discover how Reflectiz can protect your website from advanced third party based attacks

Get Web Asset Free Assessment

Request a free non-intrusive security assessment of your website, and get a report with an overview of client-side security risks.