Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Sites Hacked with Credit Card Stealers Undetected for Months

Sites Hacked with Credit Card Stealers Undetected for Months

Threat actors are gearing up for the holidays with credit card skimming attacks remaining undetected for months as payment information is stolen from customers.

Magecart skimming is an attack that involves the injection of malicious JavaScript code on a target website, which runs when the visitor is at the checkout page.

The code can steal payment details such as credit card number, holder name, addresses, and CVV, and send them to the actor.

Also Read: Understanding The Data Intermediary In Data Protection

Threat actors may then use this information for purchasing goods online or sold to other actors on underground forums and dark web marketplaces known as “carding” sites.

The SCUF connection

In October 2021, Akamai researchers discovered a Magecart attack on SCUF Gaming International, a leading manufacturer of custom PC and console controllers, which resulted in the compromise of the financial details of 32,000 people.

By investigating deeper, the analysts found that the same actor responsible for the attack against SCUF was operating an extensive network of skimmers that stole credit card details from several sites.

These are:

  • – Shoes and footwear (Alexa rank: 425k)
  • – Jewelry (Alexa rank: 1.4 M)
  • – Fashion apparel (Alexa rank: 85k)
  • – Sleep products
  • – Professional audio equipment (Alexa rank: 150k)
  • – Professional beverage accessories (Alexa rank: 113k)
  • – Clothing and special apparel (Alexa rank: 1.2 M)

The smaller the Alexa rank number, the more traffic that website receives, so the longer the skimmer stays undetected, the more credit card details Magecart actors steal.

As such, actors limit the activity on their scripts to only valuable pages to keep their skimmers hidden on infected sites, making Akamai’s investigation harder.

“We found that the skimmer’s command and control (C2) server responds with clean code when running on non-sensitive pages…,” explains Akamai’s report.

“…and (the skimmer) only sends the malicious code if it runs on checkout pages, where credit card information can be found.”

Another anti-detection technique followed by Magecart actors is registering a new skimming domain for each targeted website.

If their skimming operation is exposed/discovered, they deactivate that domain and continue the malicious activities on the other sites.

In this particular case, the actors used the same C2 domain for four websites, so a small cluster was unveiled almost at once.

Also Read: How Being Data Protection Trained Can Help With Job Retention

Vigilance advised during Christmas

Consumers who indulge in online shopping are advised to be extra cautious during Christmas when Magecart actors increase their efforts.

Detecting skimmers is the responsibility of e-commerce site owners, not their visitors, so the latter can instead do the following:

  • Use an up to date internet security solution
  • Prefer paying with electronic methods instead of cards
  • Use one-time “virtual” card solutions
  • Pay with cash on delivery if possible

If you have bought anything using your credit card from the seven websites listed above this year, consider your payment details compromised and call your bank to request a card replacement.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us