Report URI ads

One loader. Two completely different attacks. Our latest research uncovered a shared malicious infrastructure capable of delivering either: 💳 A Magecart skimmer designed to steal payment-card data 💻 A ClickFix payload designed to trick users into compromising their own machines The loader inspects the compromised website and serves the attack best suited to the victim—turning a single piece of infrastructure into a flexible platform for both client-side data theft and social engineering. We break down the loader, its decision-making, the payloads and the infrastructure connecting the two campaigns: https://lnkd.in/edK9eFuE #CyberSecurity #Magecart #ClickFix #ThreatResearch #JavaScript

Stripe just made CSP a compliance requirement. Merchants completing their annual PCI assessment are now asked to attest that they’ve deployed a Content Security Policy. That’s a major shift from “you should deploy CSP” to “confirm that you have.” Here’s what changed and why it matters: https://lnkd.in/dyaKWUUV

Magento has shipped with Content Security Policy enabled by default since version 2.3.5, but without a reporting endpoint, the telemetry generated by visitors’ browsers goes nowhere. In our August crawl of the top million sites, we found 2,568 sites taking card payments behind a report-only CSP with no reporting endpoint. Of those, 2,236 were running Magento. We've released a free, MIT-licensed Magento module that configures the four reporting fields and allows you to receive telemetry. The module is currently in beta, details in the blog post: https://lnkd.in/d6mmR7Bd Works with: Adobe Commerce - Magento Association - Mage-OS

The analytics tag, the A/B tester, the tag manager that can inject anything. Report URI inventories every script on your payment page and catches changes as they happen.

There's no "not applicable." You're attesting every script on your payment page is accounted for — Stripe's and everyone else's. Report URI builds that inventory from what actually loads, and exports the evidence to back the box you ticked.

🚀 Connection Allowlist is now in open beta at Report URI! Think of it as an egress firewall built directly into the browser: you define where a page is permitted to make connections, and the browser blocks everything else. That means even if malicious code executes through a compromised third-party script, supply-chain attack, XSS vulnerability or anything else, it can’t simply send stolen data to an attacker-controlled server. Report URI collects and processes Connection Allowlist reports from real browsers, giving you visibility into attempted connections and the data needed to safely build and deploy your allowlist. The open beta is available now to all customers. Learn how it works and how to get started: https://lnkd.in/eD9TGkwY #WebSecurity #AppSec #BrowserSecurity #DataSecurity