Formjacking Compromises 4,800 Sites Per Month. Could Yours Be One?

Cybercriminals see formjacking as a simple opportunity to take advantage of online retailers – and all they need is a small piece of JavaScript.

For a while, it was ransomware. Then it was cryptojacking. Now researchers point to formjacking as the latest threat-of-the-moment and means for hackers to get quick cash.
Cybercriminals have turned to formjacking as ransomware and cryptojacking yield less profit, according to Symantecs Internet Security Threat Report (ISTR), Volume 24. Symantec reports it blocked more than 3.7 million formjacking attacks on endpoints in 2018, with nearly one-third of those taking place during November and December as holiday shopping season ramped up.
Formjacking attacks are simple: Cybercriminals input malicious code onto retailers websites and lift customers payment card details. Conservative estimates indicate they collected tens of millions of dollars last year by using stolen data in credit card fraud or selling consumers records on the Dark Web. Ten stolen cards from each compromised website could generate up to $2.2 million total in profit for attackers, Symantec reports. A single card can fetch up to $45 in underground forums.
Kevin Haley, director of security response at Symantec, says formjackings growth is reminiscent of the time ransomware began to spike back in 2012. Nobody knew what it was, but we saw this significant growth, and we saw that it would be a big deal moving forward, he explains.
Now cybercriminals see formjacking as a simple opportunity to take advantage of online retailers. All they need is a small piece of JavaScript; from there, they can take advantage of a website vulnerability or infect a third-party application the site is using. The rise in formjacking is coupled by an increase in supply chain attacks as hackers use those to get onto target sites.
Magecart is a primary driver of the formjacking trend, Haley says. The threat group was behind several high-profile formjacking attacks in 2018 against targets including Ticketmaster and British Airways. Its attackers
have infiltrated
more than 800 e-commerce sites with card skimming software installed on third-party components and services used by the victims.
The British Airways and Ticketmaster attacks made headlines, but Haley says the majority of websites infected with formjacking attacks are for small and midsize businesses (SMBs). Unlike major corporations, SMBs lack the resources to detect and mitigate these types of threats.
They become more tempting targets, easier to get on, he continues. They may not score as much as you would with a large retailer, but you can be there for a long period of time and get a consistent number of credentials and credit card information.
Dont Worry: Ransomware and Cryptojacking Are Still Here
Formjacking may have spiked, but it hasnt completely eclipsed cryptojacking and ransomware. The latter two threats have changed, researchers report, but they havent entirely disappeared.
Data shows ransomware declined 20% overall – its first drop since 2013 – but enterprise ransomware increased 12%. More than 80% of all ransomware infections hit businesses. The shift is likely due to a decline in exploit kit activity, researchers report, as this was previously a key channel for ransomware delivery. Most ransomware attacks in 2018 spread via email, which remains the primary communication tool for most organizations.
The major propagation and attack method is via email, and its less and less accessible against consumers as they change their habits, Haley explains. People are more likely to read emails on their phones than their PCs. Most major ransomware families still target Windows-based computers, making consumers less vulnerable as attacks dont execute on smartphones.
And, of course, theres the financial factor: Theres a much bigger payday if you get into an enterprise, he adds. Consumers may not have the money or willpower to pay attackers for personal files. Businesses are more likely to pay ransom if an attack could shut them down.
Cryptojacking is down but still popular. Last year, Symantec blocked nearly 69 million cryptojacking events, more than four times the amount blocked in 2017. However, researchers detected a 52% drop in cryptojacking events between January and December 2018. During the same time periods, cryptocurrency Monero lost 90% of its value, they explain in the
newest ISTR report
.
Theres still money to be made, but its harder, says Haley of the threat. You have to infect more machines. And while cryptojacking is still an easy feat for most attackers, it will become more difficult to make the same amount of money if they need access to more devices. Many of them are targeting businesses, which have larger numbers of more powerful devices.
Related Content:
19 Minutes to Escalation: Russian Hackers Move the Fastest
6 Tax Season Tips for Security Pros
Valentines Emails Laced with Gandcrab Ransomware
High Stress Levels Impacting CISOs Physically, Mentally

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps