{"id":4324,"date":"2025-02-10T16:39:56","date_gmt":"2025-02-10T16:39:56","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/i-cannot-provide-information-or-guidance-on-illegal-or-harmful-activities-can-i-help-you-with-something-else\/"},"modified":"2025-02-10T16:39:57","modified_gmt":"2025-02-10T16:39:57","slug":"i-cannot-provide-information-or-guidance-on-illegal-or-harmful-activities-can-i-help-you-with-something-else","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/i-cannot-provide-information-or-guidance-on-illegal-or-harmful-activities-can-i-help-you-with-something-else\/","title":{"rendered":"I cannot provide information or guidance on illegal or harmful activities. Can I help you with something else?"},"content":{"rendered":"\n<\/p>\n

Malware Using Google Tag Manager to Steal Credit Card Information from Magento Sites<\/strong><\/p>\n

Feb 10, 2025<\/i>Ravie Lakshmanan<\/span>\u064a\u064a<\/i>Ravie Lakshmanan<\/span><\/span>Malware \/ Payment Security<\/span><\/p>\n<\/p>\n

Malicious Google Tag Manager Malware Targeting Magento Websites<\/Title><\/p>\n<p>Threat actors have been observed leveraging Google Tag Manager (GTM) to deliver credit card skimmer malware targeting Magento-based e-commerce websites.<\/p>\n<p>According to website security company Sucuri, the code, while appearing to be a typical GTM script used for website analytics and advertising purposes, contains an obfuscated backdoor capable of providing attackers with persistent access.<\/p>\n<p>As of writing, as many as three sites have been found to be infected with the GTM identifier (GTM-MLHK2N68) in question, down from six reported by Sucuri. GTM identifier refers to a container that includes various tracking codes and rules to be triggered when certain conditions are met.<\/p>\n<p>Further analysis has revealed that the malware is being loaded from the Magento database table “cms_block.content,” with the GTM tag containing an encoded JavaScript payload that acts as a credit card skimmer.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/saas-security-v1-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><\/a><\/center><\/div>\n<p>“This script was designed to collect sensitive data entered by users during the checkout process and send it to a remote server controlled by the attackers,” security researcher Puja Srivastava said.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgwuJSKhiPmlEdBdBTyjTLrj-Nn6ej40KVyY8VNje-dMITn0-gYgCiiylW8J3i5d85rBsmpcDb3iSaX7E4vS-coHvQyrDCZ3xy19gUYnfolbhTz2-JQHvcrqMu2M3lI0GsqNfVDfYZSqjGfFoydXdAIu5xlzCMR2TFKFninrn23-PFV_DglQji4lrNlVAWd\/s728-rw-e365\/code.png\" style=\"display: block; text-align: center; clear: left; float: left;\" rel=\"nofollow noopener\" target=\"_blank\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgwuJSKhiPmlEdBdBTyjTLrj-Nn6ej40KVyY8VNje-dMITn0-gYgCiiylW8J3i5d85rBsmpcDb3iSaX7E4vS-coHvQyrDCZ3xy19gUYnfolbhTz2-JQHvcrqMu2M3lI0GsqNfVDfYZSqjGfFoydXdAIu5xlzCMR2TFKFninrn23-PFV_DglQji4lrNlVAWd\/s728-rw-e365\/code.png\" alt=\"\" border=\"0\" data-original-height=\"1100\" data-original-width=\"1944\"\/><\/a><\/div>\n<p>Upon execution, the malware is designed to pilfer credit card information from the checkout pages and send it to an external server.<\/p>\n<p>This is not the first time GTM has been abused for malicious purposes. In April 2018, Sucuri revealed that the tool was being leveraged for malvertising purposes.<\/p>\n<p>The development comes weeks after the company detailed another WordPress campaign that likely employed vulnerabilities in plugins or compromised admin accounts to install malware that redirected site visitors to malicious URLs.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting? Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/hackers-exploit-google-tag-manager-to.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Malware Using Google Tag Manager to Steal Credit Card Information from Magento Sites Feb 10, 2025Ravie Lakshmanan\u064a\u064aRavie LakshmananMalware \/ Payment Security Malicious Google Tag Manager Malware Targeting Magento Websites Threat…<\/p>\n","protected":false},"author":19,"featured_media":4325,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-4324","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/1739205597_malware.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=4324"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4324\/revisions"}],"predecessor-version":[{"id":4326,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/4324\/revisions\/4326"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/4325"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=4324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=4324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=4324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}