November 19, 2021

The Sansec Threat Research Team recently uncovered a malicious activity in which threat actors infiltrate credit card skimmers into the websites of online stores to deploy Linux malware on compromised e-commerce servers.

The attackers use a PHP-encoded web skimmer to download and infiltrate fake payment forms on the checkout pages, which are displayed to customers through the hacked online store.

Other discoveries by the security company include the malware receiving commands from a Beijing server hosted on Alibaba’s network, and achieving persistence by adding a new crontab entry that fulfills two main tasks: downloading the malicious payload from its command-and-control server and reinstalling the back door if it is detected.

As soon as the malware is started, it immediately removes itself from the disk and disguises itself as “ps _ ef.” This is used to get a list of currently running processes.

For more information, read the original story in Bleeping Computer.