New 3rd party JS script attack found: Artifyau[.]com and Quantifymy[.]com

TL;DR: polyglot HTML+JS jqwery.js Magecart skimmer via Cloudflare-cloaked domains

• Feeds missed it: Threat feed vendors call themselves the last line of defense. Only one of them flagged artifyau[.]com or quantifymy[.]com on VirusTotal at the time of publishing, and our purpose-built crawler found the pattern within 24 hours of deployment.
• How the polyglot worked: The malicious file loaded a polyglot document that renders as a fake maintenance page in a browser and executes as a Magecart skimmer when injected into another site, with setTimeout(_0x3481cd, 1000) anti-debug and Cloudflare cloaking. cside's browser-layer agent caught and blocked both domains in testing before the jqwery.js payload could steal a single card.
• Add runtime inspection: If your security stack still trusts VirusTotal domain reputation as a primary control on checkout pages, that assumption cost the industry the entire quarter that this campaign ran. Add runtime script inspection this week.

Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.

This week, we deployed a specialized crawler for research purposes. Within just 24 hours, it identified new Magecart attack patterns. Magecart is a sophisticated, financially motivated threat that injects malicious JavaScript to steal personal payment information. Here's a list of the biggest Magecart attacks thus far.

Initial detection: obfuscated JavaScript on Artifyau[.]com

Detected URL: https://artifyau[.]com/T1M0dVluVnBiR1J6YVhSbGNISnZMbU52YlE9PQ/jqwery.js.

The URL mimics a legitimate JavaScript file, resembling jQuery, but a quick look reveals a misspelling ("jqwery" instead of "jquery") - a common tactic to mask attacks. On inspection, the file contained highly obfuscated JavaScript, likely crafted to evade detection. Here's a snapshot of the code structure:

And here deobfuscated and normalized:

This type of obfuscation is common in Magecart scripts which aim to steal credit card information by injecting rogue code into the checkout pages of compromised sites.

The suspicious domain: a closer look

A quick lookup revealed that artifyau[.]com was registered on October 15, 2024, and is set to expire in a year. Here's the basic metadata we gathered:

The domain was cloaked behind Cloudflare, and a quick search showed it was up for sale - an odd things for a site supposedly hosting legitimate scripts.

From URL scan we found multiple websites were infected: https://urlscan.io/search/#artifyau.com

Analysis of the HTML page and secondary domain

The injected script tag:

This then loads a polyglot document. In a security context, polyglots, are files that are a valid form of multiple different file types. In this case, valid as HTML as well as JavaScript, both at the same time:

This is commented out HTML code where the malicious JS is at the bottom of the commented out HTML file, likely to evade detection:

If someone visits this website directly from the browser, this will render the below page:

If this is injected in the website, this will be loaded as JavaScript. This then loads the final stage of malicious JavaScript, which in turn loads the jqwery.js file. Decoded, it looks like this:

It reveals multiple anti-debugging tricks and timeout code, just like other known Magecart JS files. Including:

• setTimeout(_0x3481cd, 1000);

This then used to steal the PII and credit card info of the people visiting these sites.

On detailed analysis we found the new domain used by the threat actor quantifymy[.]com.

Both these domains are behind Cloudflare to hide their original IP.

We found another list of websites infected through this URL: https://urlscan.io/search/#quantifymy.com

Only the domain is different, all the other TTPs remains the same as described above.

Protect your site

At the time of pusblishing this, only one threat feed vendor reported these domains as malicious VirusTotal:

• https://www.virustotal.com/gui/domain/quantifymy.com
• https://www.virustotal.com/gui/domain/artifyau.com

In a separate incident investigated the same quarter, a single third-party JavaScript file from cdn.csyndication[.]com deployed four distinct backdoors across 1,000 WordPress sites simultaneously, see four backdoors in one 3rd-party JavaScript attack.

cside checks each 3rd party script being fetched by the browser. In our testing, it caught and blocked these domains before the script could render. You can sign up here.