Comprehensive framework for understanding, detecting, and defending against e-skimming attacks
E-skimming attacks have caused billions in damages and affected millions of customers worldwide. This framework provides comprehensive analysis of attack techniques, tactics, and procedures used by threat actors to compromise e-commerce platforms.
This document presents a customized MITRE ATT&CK matrix specifically designed for e-skimming (web skimming, formjacking, Magecart) attacks. Based on extensive research and analysis of real-world e-skimming campaigns, this matrix maps attack techniques, tactics, and procedures (TTPs) used by threat actors to compromise e-commerce platforms and steal payment card data.
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 4 techniques | 1 technique | 4 techniques | 3 techniques | 9 techniques | 4 techniques | 6 techniques | 0 techniques | 5 techniques | 1 technique | 4 techniques | 5 techniques |
|
T1059.007
JavaScript Execution
|
No techniques commonly used in e-skimming attacks
|
The techniques used by attackers to gain initial entry into the target e-commerce infrastructure.
Exploitation of vulnerabilities in e-commerce platforms to gain access.
Use of stolen or compromised credentials to access e-commerce admin panels.
Manipulation of third-party services, libraries, or dependencies to inject malicious code.
Compromising GTM containers to inject persistent skimmers that bypass traditional security controls.
Sophisticated attack on NPM ecosystem affecting 2 billion weekly downloads.
Hiding malicious code in image metadata, CSS files, and favicons to bypass detection.
Techniques used to run malicious code on the victim's browser or server.
Techniques to maintain access and continue operations over extended periods.
Modification of legitimate JavaScript files to include skimmer code.
Use of malicious or compromised browser extensions for persistent access.
Techniques to avoid detection by security tools and analysts.
Code obfuscation to evade detection and analysis.
Anti-debugging techniques to prevent security analysis.
Conditional execution based on environment to evade detection.
Disguising malicious code as legitimate services or libraries.
Exfiltrating stolen data through attacker-controlled Google Analytics accounts to bypass CSP restrictions.
Detecting analysis environments via WebGL renderer queries to avoid security researchers.
Techniques to gather payment card data and personal information from victims.
Collection of data stored locally in browser storage.
Techniques to transmit stolen payment data to attacker-controlled infrastructure.
| Attack Stage | Detection Method | Tools | Indicators |
|---|---|---|---|
| Initial Access | Log monitoring, WAF | SIEM, WAF, Access Reviews | Unusual admin access, exploit attempts |
| Execution | CSP violations, script analysis | Browser DevTools, Semgrep, AI analysis | Unexpected scripts, CSP reports |
| Persistence | SDLC integrity checks, CDN/WAF injection monitoring | OSSEC, Tripwire | File modifications, unauthorized changes |
| Defense Evasion | Static analysis, deobfuscation, selective execution | de4js, JsDeObsBench, js-beautify, script analysis | High entropy, eval(), obfuscation, detection of analysis tools/environment |
| Collection | Runtime monitoring, event analysis | Custom scripts, extensions | Unexpected form access, input listeners, form overlay |
| Exfiltration | 3rd party key/id monitor, CSP-report-only | CSP-report-only custom monitor, HAR change detection | New domains, especially typo-squatted ones |
Restrict script sources and block unauthorized scripts.
<meta http-equiv="Content-Security-Policy"
content="default-src 'self';
script-src 'self' https://trusted-cdn.com;
connect-src 'self';
report-uri /csp-report">Cryptographic hash verification for external scripts.
<script src="https://cdn.example.com/lib.js"
integrity="sha384-oqVuAfXRKap7..."
crossorigin="anonymous"></script>Prevent credential-based compromise of admin accounts.
Detect unauthorized file modifications in real-time.
Monitor all outbound traffic from checkout pages.
Monitor form field access patterns and event listeners.
// Monitor unauthorized form access
Object.defineProperty(HTMLInputElement.prototype, 'value', {
get: function() {
if (isPaymentField(this) && !isAuthorized()) {
console.trace('Unauthorized access!');
}
return originalGetter.call(this);
}
});eval(atob(...)) patternsquerySelector('[name*="card"]') in unknown scriptsdocument.cookie enumeration on checkout pagesnew WebSocket() on payment formsnavigator.sendBeacon() with form data