Major e-cigarette store hacked to steal credit card details
Element Vape’s checkout page was carrying MageCart, experts found
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Element Vape, a popular online retailer selling e-cigarettes and accompanying accessories, has had its website compromised and loaded with the popular credit card skimmer, MageCart.
The news was revealed byBleepingComputer, whose analysts investigated the website’s code, and found the skimmer on the checkout page. The skimmer was stealing information such as email addresses, credit card numbers and expiration dates, phone numbers, billing addresses, and street and ZIP codes.
As soon as the existence of the skimmer was confirmed, the publication notified Element Vape, which reacted promptly, eliminating the malicious code from its website on the same day.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Recent attack
How the code ended up on the webpage in the first place remains a mystery, and it’s hard to tell if any of the company’sendpointswere infected with malware.
The name of the threat actor is also unknown. The publication says the data stolen gets exfiltrated to an obfuscated, hardcoded Telegram address.
What the investigation did discover is that the attack is most likely of a newer date, as the code wasn’t present on the site in early February this year.
MageCart attacks return to target hundreds of outdated ecommerce sites>Retailers using WooCommerce are the next target for Magecart card skimmer attacks>Magecart attacks hit thousands of UK SMBs ahead of Black Friday
Element Vape has been attacked before,BleepingComputersays. Back in 2018, it notified its customers of potentially leakingpersonally identifiable information(PII) to unknown threat actors.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The consumers filed a lawsuit, claiming the company did not notify affected individuals on time, and did not do all it could to prevent the incident from happening in the first place. The lawsuit was followed by a class-action one in 2019, demanding a trial by jury.
While the community’s response to Element Vape seems to be mostly positive, across social media, there are a few potential red flags, BleepingComputer hints. For example, in some U.S. states, it’s known as TheSY LLC, and has a Twitter userbase of 13,000. However, its tweets are protected, which is not what you’re used to seeing from a company.
Element Vape is yet to comment on the findings. Customers interacting with the company are advised to keep both eyes on their credit cards, for suspicious transactions.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
