Threat video1:00
Outsider Shopify Checkout Phishing: Detection & IOCs
Fake Shopify stores redirect checkout to live phishing that takes cards and OTPs. Includes 9 detection rules (one free in Splunk SPL) and 22 IOCs.
Read the full threat intel for Outsider Shopify Checkout Phishing: Detection & IOCs →
Chapters
- 0:00The hookRoughly 2,000+ Outsider stores harvest card data.
- 0:04The storyFraudulent ads drive shoppers to fake stores.
- 0:11Attack pathKit registers fake domains and stores.
- 0:25AttributionAttributed to Outsider PhaaS operators.
- 0:31Indicators of compromise13 indicators to hunt: 9 domains, 1 URL and 2 file names, and more.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Block the listed JWR and Playswing domains at DNS.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Roughly 2,000+ Outsider stores harvest card data.
0:05Fraudulent ads drive shoppers to fake stores.
0:08Checkout redirect steals card data.
0:11Kit registers fake domains and stores.
0:14Malicious checkout redirect intercepts card data.
0:17Operator watches and relays approvals.
0:20Stolen funds exit to separate merchants.
0:26Attributed to Outsider PhaaS operators. Confidence: medium.
0:3113 indicators to hunt: 9 domains, 1 URL and 2 file names, and more.
0:3811 ATT&CK techniques, from reconnaissance to impact.
0:434 steps now: Block the listed JWR and Playswing domains at DNS.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.