{"id":14089,"date":"2020-06-25T21:04:00","date_gmt":"2020-06-25T18:04:00","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=14089"},"modified":"2026-03-27T19:16:45","modified_gmt":"2026-03-27T16:16:45","slug":"attackers-have-found-a-new-way-to-steal-online-shoppers-payment-details-using-a-popular-web-analytics-service","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/attackers-have-found-a-new-way-to-steal-online-shoppers-payment-details-using-a-popular-web-analytics-service\/","title":{"rendered":"Attackers have found a new way to steal online shoppers\u2019 payment details using a popular web analytics service"},"content":{"rendered":"

Kaspersky researchers have uncovered a new technique for stealing users\u2019 payment information on online shopping websites\u2014a type of attack known as web skimming. By registering for Google Analytics accounts and injecting these accounts\u2019 tracking code into the websites\u2019 source code, attackers can collect users\u2019 credit card details. About two dozen online stores worldwide were compromised using this method.<\/strong><\/p>\n

Web skimming<\/a> is a popular practice used by attackers to steal users\u2019 credit card details from the payment pages of online stores, whereby attackers inject pieces of code into the source code of the website. This malicious code then collects the data inputted by visitors to the site (i.e. payment account logins or credit card numbers) and sends the harvested data to the address specified by attackers in the malicious code. Often, to conceal the fact that the webpage has been compromised, attackers register domains with names that resemble popular web analytics services, such as Google Analytics. That way, when they inject the malicious code, it\u2019s harder for the site administrator to know that the site has been compromised. For example, a site named \u201cgooglc-analytics[.]com\u201d is easy to mistake as a legitimate domain.<\/p>\n

Recently, however, Kaspersky researchers have discovered a previously unknown technique for conducting web skimming attacks. Rather than redirecting the data to third-party sources, they redirected it to official Google Analytics accounts. Once the attackers registered their accounts on Google Analytics, all they had to do was configure the accounts\u2019 tracking parameters to receive a tracking ID. They then injected the malicious code along with the tracking ID into the webpage\u2019s source code, allowing them to collect data about visitors and have it sent directly to their Google Analytics accounts.<\/p>\n

Because the data isn\u2019t being directed to an unknown third-party resource, it\u2019s difficult for administrators to realize the site has been compromised. For those examining the source code, it just appears as if the page is connected with an official Google Analytics account\u2014a common practice for online stores.<\/p>\n

To make the malicious activity even harder to spot, the attackers also employed a common anti-debugging technique: if a site administrator reviews the webpage source code using Developer mode, then the malicious code is not executed.<\/p>\n

About two dozen websites were found to be compromised in this way, which included stores in Europe and North and South America.<\/p>\n

\u201cThis is a technique we have not seen before, and one that is particularly effective. Google Analytics is one of the most popular web analytics services out there. The vast majority of developers and users trust it, meaning it\u2019s frequently given permission to collect user data by site administrators. That makes malicious injects containing Google Analytics accounts inconspicuous\u2014and easy to overlook. As a rule, administrators should not assume that, just because the third-party resource is legitimate, its presence in the code is ok,\u201d comments Victoria Vlasova, Senior Malware Analyst at Kaspersky.<\/p>\n

Read more about this new technique for web skimming on Securelist.<\/a><\/p>\n

To stay safe from web skimming, Kaspersky experts recommend:\u00a0 <\/strong><\/p>\n