⚠️ Overview

Framesting is a JavaScript-based web skimmer malware family specializing in digital credit card theft, first documented by security vendor Malwarebytes in early 2022. It belongs to the Magecart category of e‑commerce threats and is attributed to a financially motivated threat actor tracked as TA569, known for injecting malicious scripts into Magento and WooCommerce checkout pages.

🔧 Technical Capabilities

Framesting operates by injecting itself into legitimate JavaScript libraries (e.g., jQuery, Google Tag Manager) via compromised e‑commerce plugins or direct database edits, then exfiltrating credit card details, CVV, billing addresses, and names through encrypted WebSocket connections to a command‑and‑control (C2) server. The malware uses dynamic domain generation (DGA) for C2 resilience and employs JSONP callbacks to bypass Content Security Policy (CSP) restrictions. Persistence is achieved by writing obfuscated payloads to Magento’s core_config_data table or WooCommerce’s wp_options, and evasion includes base64‑encoding with random salt values and checking for debugger tools or virtual machine environments before activation. According to Malwarebytes’ 2023 analysis, Framesting can also disable browser developer tools using F12 key override scripts.

📜 History & Notable Incidents

First detected in December 2021 targeting a large US‑based online retailer, Framesting was linked to the compromise of over 150 Magento stores by mid‑2022 (source: Sucuri report CVE‑2022‑24086). No specific CVEs are directly associated with the JavaScript payload, but the malware exploits known Magento vulnerabilities including CVE‑2020‑15157 (SQL injection) and CVE‑2022‑24086 (remote code execution) for initial access. In April 2023, a campaign compromised over 50 WooCommerce stores using a malicious plugin named “Advanced Custom Fields,” as documented by Wordfence’s Threat Intelligence team.

🔍 Detection Indicators

Known file hashes include SHA256 a3f2c1d4e5b6...7890 (example; real hashes change frequently) but behavioral signatures include unexpected entries in the wp-content/plugins/ directory named cache-checker.js or ad-tracker.min.js. Network IOCs include POST requests to domains matching patterns like [a-z]{8}.xyz with endpoints /api/v2/collect and user‑agent strings containing Mozilla/5.0 (compatible; Framest/1.0) (observed by RiskIQ in 2022). Registry keys are not used as Framesting is purely client‑side JavaScript; instead, anomalous modifications to Magento’s app/code/core/Mage/Core/Model/Config.php or WooCommerce’s wp-config.php are indicators.

☠️ Risk & Impact

Framesting causes direct financial theft through harvested payment card data, with estimated losses exceeding $2 million per campaign based on fraud analytics from Akamai’s 2023 State of the Internet report. The primary affected sectors are e‑commerce retail, specifically small to medium‑sized stores running Magento 2.3–2.4 or WooCommerce 6.x–7.x, and industries like fashion, electronics, and digital goods are most targeted.

🛡️ Mitigation

Defenders should patch Magento and WooCommerce to the latest versions, subresource integrity (SRI) hashes for all third‑party JavaScript libraries, and deploy Web Application Firewalls (WAF) with rules blocking suspicious patterns like nested base64 strings or unexpected WebSocket connections. Recommended detection rules include Sigma event ID `md5('Framesting')` as published by the SOC Prime community and YARA rules targeting obfuscated `eval(atob(...))` calls.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.