MobileInter Skimmer that targets mobile devices

Magecart operators have modified a popular credit card skimmer (MobileInter) to target only mobile users, as consumers make more purchases online from their smartphones than from their computers. According to a new report from RiskIQ, the Inter Skimmer Kit is one of the most common digital skimming solutions in the world. Several different groups of cybercriminals have used the Inter kit since the end of 2018 to steal payment data and it affects thousands of sites and consumers around the world.

While the first iteration of MobileInter downloaded the exfiltration URLs hidden in images from the GitHub repositories, the new version contains the exfiltration URLs within the skimmer code and uses WebSockets for data exfiltration. MobileInter also abuses Google’s tracking services and domains that mimic the search giant to disguise itself and its infrastructure.

MobileInter also disguises itself and its infrastructure, relying heavily on Google to do so. It hides itself as Google’s tracking services, uses Google-mimicking domains, and abuses Google’s IPs. Because it targets mobile users, MobileInter performs various checks to make sure it is reviewing a transaction made on a mobile device.

▸It performs a regex check on the window location to determine if it is on a checkout page.

▸A regex check also determines if the user’s userAgent is configured in one of several mobile browsers, such as the iPhone.

▸The skimmer also checks the dimensions of the browser window to see if they are the expected size for a mobile browser.

Once these checks pass, the skimmer performs its data extraction and exfiltration through various other functions. Some of these are names that could be mistaken for legitimate services to avoid detection. For example, ‘rumbleSpeed’, a function that determines how often the data extraction function is attempted, is intended to be mixed with the jRumble plugin for jQuery, which “rumble” elements of a web page to attract the user’s attention.

RiskIQ has also identified MobileInter by disguising its operations in other ways. Since the company began tracking Magecart, it has observed threat actors disguising their domains as legitimate services and although credit card skimmers first appeared in the real world at gas stations and other places where users swipe finger to pay, they soon found their way online and have now established themselves on mobile devices.

See also:
Cybersecurity threats faced by mobiles
Janeleiro is a threat to personal and banking data

---