TL;DR: Shrwaa Magento CosmicSting overlay-skimmer host infrastructure
- Victim and host both: The usual skimmer story is one victim losing cards. Shrwaa flips the story: the compromised Magento 2.4 store is both a victim and the hosting infrastructure other campaigns pull their malicious JavaScript from.
- Fake form, invisible to feeds: The jquery.js overlay on Shrwaa[.]com painted a fake payment form on top of the legitimate Magento checkout, threat feeds still do not flag the domain, and the attack has likely been active since December 2023 via the CosmicSting bug. cside would have blocked the malicious code and alerted the site to remove it.
- Patch and add behavior: If your ecommerce runs Magento 2.4 without CosmicSting patched, close that gap today. If your team relies on domain reputation lists, add behavior-based detection on the client, because a two-year-old skimmer host is still invisible to threat feeds.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
What happened on Shrwaa.com
A popular e-commerce site in Kuwait, running an outdated version of Magento (2.4), has been compromised by a malicious JavaScript injection, exposing customer payment data. The vulnerability, likely linked to the CosmicSting bug in Magento, has been patched, but sites not updated remain at risk.
Unlike other impacted sites, Shrwaa[.]com is being exploited as infrastructure for additional attacks. A URL scan shows numerous sites referencing Shrwaa[.]com, which hosts multiple malicious JavaScript files:
Since this domain is currently not being flagged by threat feeds (a big issue when it comes to client-side attacks), the attackers use it as infrastructure and to speed up the process of infecting more sites.
One file called jquery.js is only loosely obfuscated, giving us insight into how the injection works. This file creates a simple HTML page that tricks users into entering their payment details. These fake pages overlay the legitimate payment forms:
Since no 3rd party script monitoring and security practice is in place, this attack remains active, and likely has been active since December of 2023.
Attacks remain common on the Magento platform. These are known as Magecart attacks, and some of the largest incidents have involved similar tactics. For prevention guidance, see our guide to client-side security for eCommerce.
If Shrwaa[.]com had cside in place, it would have blocked the malicious code and alerted the site to remove it. We have notified them and other sites of the attack.
You can protect your website for free by creating a cside account.
