Over the past couple of days a large number of Magento 1 websites (and smaller numbers of Magento 2, OpenMage, ASP.net and PHP sites) have been observed as being infected with a previously unknown card data skimmer. This has been one of the largest campaigns in recent times, we have identified more than 4,400 infected websites (and counting). The malware uses a key logging approach to extract card data from the websites’ checkout pages and sends that data back to an infrastructure under the control of the attacker.
