EKFiddle

Added 'Mag_cache' skimmer detection to EKFiddle (ref: twitter.com/MBThreatIntel/…) Rules for Fiddler Classic and Fiddler Everywhere: github.com/malwareinfosec…

ℹ️ Updated FakeUpdates/SocGholish rules for both Fiddler Classic and Fiddler Everywhere ➡️ github.com/malwareinfosec…

#FakeUpdates .breatheinnew[.]life .roles.thepowerofgodswhisper[.]com 77.91.127[.]52

💡 The latest update for #FiddlerEverywhere adds a similar feature known as the 'TextWizard' in Fiddler Classic. ➡️ Select a string and right-click 'Decode Selection'

ℹ️ It looks like the SSL certificate for maps .windows .com (Bing maps) expired 2 days ago

💡 New version of Fiddler Everywhere adds horizontal view mode.

#EKFiddle rules updates for a couple of #Magecart skimmers (greatz/Magneto) github.com/malwareinfosec…

New #Magecart domain jsconfigur[.]net ➡️ JavaScript: jsconfigur[.]net/js/config.js ➡️ Exfiltration: jsconfigur[.]net/configure/collecting.php

#Magecart exfiltration with image (hash: ad7f76306b7deced1aea2cafb9e0cdfd00716ba713b382a079c7d743a396cf87) links to previous Porkbun infrastructure. dxloc[.]buzz dylorean[.]cyou 141.98.82[.]244 5.188.62[.]10

New hostnames related to the 'Anti-sandbox' #Magecart skimmer js[.]knowledgecdn[.]org m[.]sale-alerts[.]com s[.]geotac[.]net 185.253.33[.]176 185.63.190[.]141 89.108.109[.]26

💡 #EKFiddle tip ➡️ Flag traffic by IP address with exact match or regular expression. Works for both Fiddler Classic and Fiddler Everywhere

@PaulWebSec @pancak3lullz Depends what exactly you need it for, but EKFiddle can parse the page content in real time and find patterns that you can define as well

@pancak3lullz @EKFiddle Interesting, I will check this and meanwhile, I heard about Lighthouse which is built-in Chrome, works like a charm!

Hey tweeps, any recommendation for a tool to analyze web page loading? (and not web inspector from the browser itself)

Late to the game, but #EKFiddle detection for CVE-2022-30190 (Follina) added. github.com/malwareinfosec…

Seeing a lot of 'Bom' #Magecart infections right now. Injections in compromised stores are located before the </head> tag. Article on Bom skimmer: community.riskiq.com/article/743ea7… IOCs: apfeltee[.]de www.usaayurveda[.]com

Fake slideshow #Magecart skimmer (ref: twitter.com/AffableKraut/s…) ➡️ Skimmer JS: code2a[.]com/js/lib/translate.js ➡️ Exfiltration: bsvholdingsa[.]com

New #Magecart domain contactsform[.]com ➡️ Skimmer loaded inside GIF image ➡️ Exfiltration via WebSocket Related to this twitter.com/unmaskparasite…

'Mirasvit' Magecart skimmer. Maybe tied to exploitation of the Mirasvit plugin? ➡️ Exfiltration: hubberstore[.]com

'Recaptcha' Magecart skimmer ➡️ JavaScript: cafeunido[.]com/pub/media/flag/flag.js candlemaking[.]com/media/email/logo/default/az1.js ➡️ Exfiltration: cafeunido[.]com/pub/errors/default/403.php ariaperfume[.]com/errors/default/403.php

New 'Bom' Magecart skimmer domain (compromised site) ➡️ apfeltee[.]de/js/prototype/form.js Regexes for Fiddler Classic/Everywhere available at: github.com/malwareinfosec…