Full Report
Group-IB specialists detected a new JS-sniffer family called FakeSecurity.
Analysis Summary
# Threat Actor: FakeSecurity (associated with "World Courier Service" campaign)
## Attribution & Identity
* **Actor Name:** FakeSecurity (named after the JS-sniffer family).
* **Aliases/Associations:** The group is linked to a fake entity called **"World Courier Service."**
* **Associated Identifiers:** Linked to the email address **admin[@]worldcourrierservices[.]com** (defanged) and the IP address **200.63.40[.]2** (defanged).
* **Known Associations:** Group-IB suggests this actor is likely the same group behind a January 2019 campaign involving mass phishing and password-stealing malware.
## Activity Summary
The group's recent operations involve the deployment of a new JS-sniffer family dubbed "FakeSecurity." Their campaigns are multi-stage: first, they compromise websites to host JS-sniffers or malicious files; second, they utilize social engineering (fake software updates) and mass email distribution to spread secondary malware, such as password stealers. A notable historical campaign occurred in January 2019 using similar infrastructure.
## Tactics, Techniques & Procedures
* **Magecart-style Injection:** Injecting malicious JavaScript (JS-sniffers) into e-commerce sites to steal payment card data.
* **Social Engineering:** Prompting users to download fake "Adobe Reader PDF Plugins" to deliver malware.
* **Mass Mailing:** Using mass email distribution to propagate malicious executables.
* **Malware Distribution via Compromised Sites:** Storing malicious `.exe` files in `/manuals/`, `/doc/`, or `/file_d/` directories of legitimate but compromised websites.
* **Domain Squatting/Masquerading:** Registering domains that mimic security or legitimate services (e.g., `magento-security.org`, `worldcourrierservices.com`).
**MITRE ATT&CK IDs:**
* **T1566 (Phishing):** Use of mass emails to distribute malware.
* **T1189 (Drive-by Compromise):** Use of JS-sniffers on e-commerce sites.
* **T1036 (Masquerading):** Naming malicious files as legitimate software (Adobe Reader).
## Targeting
* **Sectors:** E-commerce (Retail), Healthcare, Financial Services.
* **Geography:** Global (based on target URLs spanning UK, generic .com, and .net domains).
* **Victims:**
* Healthcare4all (UK)
* Genstattu
* E-cig
* Thepinetree
## Tools & Infrastructure
* **Malware Families:**
* **FakeSecurity:** A specialized JS-sniffer for card skimming.
* **Password Stealers:** Various unidentified password-stealing malware delivered via PE files.
* **Filenames:** `Adobe-Reader-PDF-Plugin-2.37.2.exe`, `msw070619.exe`.
* **Infrastructure:**
* **C2/Hosting IPs:** 200.63.40[.]2
* **Domains:**
* fiswedbesign[.]com
* alloaypparel[.]com
* firstofbanks[.]com
* magento-security[.]org
* mage-security[.]org
* worldcourrierservices[.]com
## Implications
The FakeSecurity group demonstrates a versatile threat profile by combining traditional web-skimming (JS-sniffers) with classic malware distribution (phishing/social engineering). By masquerading as security tools or courier services, they exploit the trust of both site administrators and end-users. The existence of at least 38 JS-sniffer families (as noted by Group-IB) indicates a rapidly crowding and evolving market for automated payment data theft.
## Mitigations
* **For E-commerce Owners:** Implement Content Security Policy (CSP) to restrict where scripts can be loaded from and where data can be sent. Regularly audit third-party JavaScript libraries.
* **For End-Users:** Exercise caution with unsolicited emails and avoid downloading software updates (like Adobe Reader) from third-party sites; always use official vendor websites.
* **Technical Defense:** Monitor for the specific IOCs (domains and hashes) listed above and block traffic to the identified malicious IP addresses.