New card-data-stealing malware hides in Nginx processes on Linux servers

E-commerce platforms in the US, Germany and France have been attacked by a new form of malware that targets Nginx servers to hide its presence and evade security solutions.

"This new code is injected into a host Nginx application and is almost invisible," Sansec's Threat Research team said in a new report. "The parasite is used to steal data from e-commerce servers, also known as server-side Magecart."

Nginx is an open-source web server that can also act as a reverse proxy, load balancer, mail proxy and HTTP cache. The advanced malware, called NginRAT, compromises a host Nginx application to embed itself in the web-server process.

The remote-access Trojan is delivered through CronRAT, another malware strain the Dutch cybersecurity company revealed last week. CronRAT hides malicious payloads in cron jobs scheduled to run on 31 February, a date that does not exist. Server-side modifications to compromised e-commerce websites allow malicious actors to skim data from online-payment forms.

These attacks, collectively known as Magecart or web skimming, are carried out by a cybercrime syndicate comprising dozens of subgroups. They steal digital credit-card data by exploiting software vulnerabilities, gaining access to an online portal's source code and injecting malicious JavaScript that siphons off information entered by shoppers at checkout.

"Skimmer groups are growing quickly and target various e-commerce platforms, using different methods to remain unnoticed," Zscaler researchers noted in an analysis of recent Magecart trends published earlier this year.

"The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically similar to legitimate web services or specific online shops to host malicious skimmer scripts."