{"id":19077,"date":"2018-11-15T16:40:37","date_gmt":"2018-11-15T16:40:37","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/29516\/One-In-Five-Magecart-Infected-Stores-Gets-Reinfected-Within-Days.html"},"modified":"2018-11-15T16:40:37","modified_gmt":"2018-11-15T16:40:37","slug":"one-in-five-magecart-infected-stores-gets-reinfected-within-days","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/one-in-five-magecart-infected-stores-gets-reinfected-within-days\/","title":{"rendered":"One In Five Magecart Infected Stores Gets Reinfected Within Days"},"content":{"rendered":"

Online stores that have been infected with the Magecart malware –known to record and steal credit card details from checkout forms– often get reinfected after clean-up operations, a recent report has revealed.<\/p>\n

\n

More security news<\/span><\/h3>\n<\/div>\n

“In the last quarter, 1 out of 5 breached stores were infected (and cleaned) multiple times, some even up to 18 times,” said Willem de Groot, a Dutch security researcher and the creator of MageReport<\/a>, an online malware and vulnerability scanner for online stores.<\/p>\n

De Groot says he’s tracked Magecart-like infections on more than 40,000 domains since 2015. The researcher says that during August, September, and October, his scanner detected Magecart-like card skimming malware on over 5,400 domains.<\/p>\n

Skimmers persisted on average for 12.7 days, but in most cases, shop owners intervened and removed the malicious code.<\/p>\n

However, despite their best efforts, some online merchants failed to properly close hackers’ entry points during clean-up operations.<\/p>\n

He says that 21.3 percent of the cleaned shops got reinfected. A large number of reinfections occurred within the first day, or after a week, but on average, the reinfection time was 10.5 days.<\/p>\n

\"magecart-reinfections.png\"<\/span> Image: Willem de Groot<\/span><\/p>\n

“Public examples of stores battling with reinfections are TechRabbit.com (2 times<\/a>), Kitronik.co.uk (4 times<\/a>) and Zapals.com (4 times<\/a>),” de Groot said<\/a>. Feedify can also be added to this list, being also reinfected twice<\/a> after cleaning an original infection.<\/p>\n

\n<\/section>\n

De Groot, who just yesterday spotted a Magecart infection on Alex Jones’ Infowars online store<\/a>, blames the reinfections on a combination of factors.<\/p>\n

“This shows that countermeasures taken by merchants and their contracted security firms often fail. There are multiple reasons for this,” he said. The expert listed:<\/p>\n