NutriBullet has become the latest in a string of Magecart victims with skimmer code implanted on the firm's domain in order to steal customer financial data.
Research made public on Wednesday by RiskIQ said the intrusions were the work of Magecart Group 8, a collective under the Magecart umbrella.
This data is then whisked away to a command-and-control (C2) server controlled by an attack group, where it may be sold in bulk or used to make fraudulent purchases.
According to RiskIQ researcher Yonathan Klijnsma, Magecart skimmer code was recently detected on the international domain for the blender manufacturer.
First spotted on February 20, the original skimmer was removed by March 1, but only five days later, another skimmer was installed. The cat-and-mouse game continued, with RiskIQ working quickly with AbuseCH and ShadowServer to take down the C2 facilitating the transfer of stolen card data.
However, on March 10, skimmer code with yet another replacement C2 address was detected.
External help and removing the external domains connected to the skimmer simply is not enough, as for as long as vulnerabilities or weaknesses in website infrastructure exist, attackers can simply deploy new malicious payloads to resume criminal operations.
The second skimmer targeted a separate resource, a submodule for jQuery, whereas the third was injected at the top of another script on the NutriBullet domain, main-build-8a9adc31.js.
TechRepublic: Coronavirus: What business pros need to know
At the time the blog post was made public, RiskIQ said it had attempted to contact NutriBullet over the course of three weeks but had received no response. The cybersecurity firm recommended that customers avoid "making any purchases on the site as customer data is endangered."
Update 15.50 GMT: The company said the team began working on March 17 to contain the issue.
A NutriBullet spokesperson told ZDNet that the company "takes cybersecurity and personal privacy extremely seriously and is dedicated to the protection of our customers."
"Our IT team immediately sprang into action this morning (3/17/20) upon first learning from RiskIQ about a possible breach," the company added. "The company's IT team promptly identified malicious code and removed it. We have launched forensic investigations to determine how the code was compromised and have updated our security policies and credentials to include Multi-Factor Authentication (MFA) as a further precaution. Our team will work closely with outside cybersecurity specialists to prevent further incursions. We thank RiskIQ for bringing this issue to our attention."
Magecart Group 8 tends to hone in on specific targets rather than use a "spray-and-pray" approach. In 2019, the threat group targeted the web infrastructure of a national diamond exchange, and by compromising the main backend, the group was able to infect multiple local domains.
"Given the lucrative nature of card skimming, Magecart attacks will continue to evolve and surprise security researchers with new capabilities," Klijnsma said. "They're learning from past attacks to stay one step ahead, so it's on the security community to do the same."
ZDNet has reached out to NutriBullet and will update if we hear back.
Previous and related coverage
- Open database leaked 179GB in customer, US government, and military records
- 700,000 Choice Hotels records leaked in data breach, ransom demanded
- UniCredit reveals data breach exposing 3 million customer records
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0