Whilst there are many phishing scams around, at least you have a chance to spot them. You can’t really say the same for online fraud card skimming, formjacking malware such as Magecart will continue to be a huge problem for retailers and their customers. Shoppers aren’t able to easily detect the malware because it runs on the server side with no noticeable differences from a legitimate transaction on the customer’s side. Scammers will be keen to target and inject their payloads into the websites used by small businesses, as they may not be as secure against threats like large organisations. Now I am going to explain what formjacking is and additionally how it can catch you out. From a scamming point of view, an online form is targeted so that when the user completes it, the information that is inputted also gets sent to the scammer. You could think of it like the petrol station card scamming trick, where a secondary reader is used, so that any cards swiped replicates the payment data and this is then resulting in fraud.
Technically it is far more challenging than that, as the hackers are deploying a malicious JavaScript code that will capture secure data directly from the HTML before its then sent to the website server. When you see old examples of this, hackers are trying to hide their tools in the server under deceptive names like gocgle.com (replacing the o with a c). Now they are clearly using legitimate and manipulative tools to avoid detection. They attack a third-party JavaScript vendor, meaning your website infrastructure doesn’t necessarily need to be breached for formjacking code to be inserted. Ultimately this means the risk for organisations targeted is extremely high.