Full Report
Group-IB researchers have discovered 38 families of JS-sniffers, whereas only 12 were known previously.
Analysis Summary
# Tool/Technique: JS-sniffers (Digital Skimming)
## Overview
JS-sniffers (JavaScript sniffers) are a type of malicious JavaScript code designed to be injected into e-commerce websites. Their primary purpose is to intercept and steal sensitive information entered by users on payment pages, such as credit card numbers, CVV codes, names, addresses, and login credentials. This technique is often referred to as "Magecart" or digital skimming.
## Technical Details
- **Type:** Malware family / Technique
- **Platform:** Web Browsers / E-commerce CMS (Magento, Shopify, WooCommerce, etc.)
- **Capabilities:** Form grabbing, data exfiltration, bypass of client-side security, evasion of static analysis.
- **First Seen:** Early variants identified circa 2016-2017; significantly expanded in 2018.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **T1190 - Exploit Public-Facing Application**: Exploiting vulnerabilities in CMS plugins to inject scripts.
- **T1195.002 - Supply Chain Compromise**: Compromising third-party libraries or CDNs.
- **[TA0003 - Persistence]**
- **T1505.003 - Server Software Component: Web Shell**: Used to maintain access and reinject scripts if deleted.
- **[TA0009 - Collection]**
- **T1185 - Browser Session Hijacking**
- **T1539 - Steal Web Cookies**
- **T1555 - Credentials from Web Browsers**
- **[TA0010 - Exfiltration]**
- **T1041 - Exfiltration Over C2 Channel**
## Functionality
### Core Capabilities
- **Form Interception:** Automatically monitors HTML input fields (specifically payment forms) and captures data as the user types or upon clicking the "Submit" button.
- **Data Exfiltration:** Sends captured data to attacker-controlled Gateways/C2 servers via HTTP GET or POST requests, often encoded in Base64 or encrypted.
- **Targeting Specific Pages:** Scripts often include checks to ensure they only execute on checkout or payment pages to minimize noise and detection risk.
### Advanced Features
- **Obfuscation:** Use of high-level obfuscation and packing to hide the script's true intent from scanners.
- **Domain Mimicry (Typosquatting):** Hosting malicious scripts on domains that look like legitimate services (e.g., `google-analytics.cm`, `slickjs.org`, `authorizecdn.com`).
- **Anti-Debugging:** Detecting if a browser’s Developer Tools are open and halting execution to prevent analysis by researchers.
- **Payment Gateway Emulation:** In advanced cases, replacing the entire checkout form with a fake one to bypass third-party payment iframe protections.
## Indicators of Compromise
### Network Indicators (Defanged)
* map-js[.]link
* smart-js[.]link
* adorebeauty[.]org
* security-payment[.]su
* braincdn[.]org
* sagecdn[.]org
* slickjs[.]org
* authorizecdn[.]com
* slickmin[.]com
* freshchat[.]info
* 3lift[.]org
* abtasty[.]net
### Behavioral Indicators
- Unauthorized modifications to `header.php`, `footer.php`, or core JavaScript files.
- Outbound network requests to unknown third-party domains during the checkout process.
- Presence of encoded/obfuscated script blocks at the bottom of legitimate `.js` files.
## Associated Threat Actors
- **Magecart Groups (1 through 12+)**: A loose umbrella of cybercrime groups specializing in digital skimming.
- **Group-IB identified 38 distinct families**, indicating a much broader landscape of independent actors using custom or rented "sniffing" kits.
## Detection Methods
- **Signature-based detection:** Scanning server files for known JS-sniffer code patterns and regex strings.
- **Behavioral detection:** Monitoring Document Object Model (DOM) changes and identifying unauthorized data transmissions to external domains.
- **Integrity Monitoring:** Using File Integrity Monitoring (FIM) to alert on any changes to the website’s source code.
- **YARA Rules:** Creating rules to identify common obfuscation patterns used by families like "Prestige" or "CoffeeMokko."
## Mitigation Strategies
- **Content Security Policy (CSP):** Implementing strict CSP headers to restrict which domains can execute scripts and where data can be sent.
- **Subresource Integrity (SRI):** Using SRI hashes for third-party scripts to ensure the code hasn't been tampered with.
- **Regular Patching:** Keeping e-commerce platforms (Magento, etc.) and all plugins updated to prevent initial exploitation.
- **Two-Factor Authentication (2FA):** Mandatory 2FA for all administrative backend access to prevent manual script injection.
## Related Tools/Techniques
- **Formjacking:** The broader term for stealing data from web forms.
- **Web Shells:** Often used as the delivery mechanism for JS-sniffers.
- **Grelos Sniffer / Rangatira:** Specific notable families within the JS-sniffer ecosystem.