Credit-Card Skimmer Has Unlikely Target: Microsoft ASP.NET Sites

In The Name OF Allah

Al-Salam Alekum

Good  

Quote:A campaign discovered by Malwarebytes Labs in mid-April has lifted credentials from a number of e-commerce portals.


Researchers have identified a credit-card skimming campaign that’s been active since mid-April that has a rather specific and unusual target: ASP.NET-based websites running on Microsoft Internet Information Services (IIS) servers.

New research from Malwarebytes Labs recently uncovered the campaign, which already has compromised at least a dozen websites that range from sports organizations, health and community associations, and a credit union — all via a malicious code injected into existing JavaScript libraries on each of the sites.

The campaign seems to be exploiting an older version of ASP.NET, version 4.0.30319, which is no longer officially supported and contains multiple vulnerabilities, according to the report by Malwarebytes director of threat research Jerome Segura.

The Soruce

Wa Salam Alekum

* This article was originally published here