The current coronavirus pandemic has resulted in the closure of many pubs, restaurants, and brick-and-mortar retail stores. Many purchases that would previously have been made in person now take place online. In research commissioned by Visa, 89% of Britons have shopped online since the UK’s lockdown restrictions began, with 31% buying items online for the first time during this period. This increase in online shopping activity benefits criminal groups in that: smaller businesses newly reliant on online transactions provide attackers with a stream of inadequately-defended shopping sites to exploit, and buyers are far more likely to be driven to these compromised shops or to fake shops compared to before the pandemic.

JavaScript skimmers run on compromised shopping sites. When shoppers enter their payment details, the skimmer secretly sends a copy to the attacker - potentially even if the customer does not complete the transaction. Even the most careful of users can be victims of these attacks, as they appear on compromised but otherwise well-intentioned shops with no visual indication of their presence.

Fake shops are another threat. Shoppers seeking bargains may unknowingly find themselves on a fake shop which claims to offers the products they want at a highly discounted price, but the victim will subsequently only receive counterfeit goods, no goods at all, or have the transaction aborted after entering credentials which is equivalent to a phishing attack.

Fake shops also take advantage of the pandemic by offering goods in high demand due to coronavirus, such as N95 masks. The FBI has released a Public Service Announcement about an increase in online shopping scams involving the sale of counterfeit healthcare products such as Personal Protective Equipment (PPE). To date, Netcraft has blocked over a thousand such coronavirus-themed fake shops, 80,000 other fake shops selling all sorts of counterfeit goods, and around 3,500 compromised shops hosting JavaScript skimmers.

The Netcraft browser extension and mobile apps provide protection against fake shops as well as legitimate shopping sites that have been compromised with JavaScript skimmers. When an extension or app user visits one of these dangerous shops, Netcraft will block access to the shop and alert them:

Continue reading

Netcraft has updated its browser extension to add protection against malicious JavaScript, including shopping site skimmers and web miners.

The Netcraft Extension now protects against malicious JavaScript

Shopping site skimmers are malicious JavaScript programs that steal your payment card information when you checkout on a compromised online store, and send it back to a fraudster to use later. These attacks have affected a large number of online shops, and are invisible to even the most vigilant shoppers as there is no visual change to the page.

Web miners are malicious JavaScript programs inserted by fraudsters into a website that let them steal your CPU power to mine for cryptocurrency using your browser without your consent. Browsing a website with a web miner can often slow down your computer by consuming its resources.

Netcraft proactively scans for new shopping site skimmers, web miners, and other malicious JavaScript on the web. In the past six months, we have found malicious JavaScript affecting over 70,000 sites on over 29,000 distinct IPs. We have identified these attacks on high-profile sites such as Cleor (a large French jewellery retailer), Misfit (a wearable devices brand), and Arctic (a PC components and accessories retailer), as well as on the personalized merchandise stores for dozens of sports clubs, including Southampton's and Swansea's.

A well-hidden shopping site skimmer

By using the Netcraft Extension you can get protection from these types of attack as soon as we detect them. It was first made available for Internet Explorer in 2004, Firefox in 2005, Chrome in 2012, Opera in 2013, and Microsoft Edge earlier this year.

Select your browser to download the Netcraft Extension now:

If you already have the Netcraft Extension installed your browser will update it automatically.

The Netcraft app for Android also provides protection against these attacks, while the Netcraft app for iOS provides protection against phishing attacks.

The Netcraft Anti-Phishing Extension is now available for Microsoft Edge.

Netcraft anti-phishing extension on Microsoft Edge.

The Netcraft Anti-Phishing Extension provides phishing and XSS protection as well as informing you about the websites you visit. It was first made available for Internet Explorer in December 2004, followed by Firefox in 2005, Chrome in 2012 and Opera in 2013. Microsoft Edge is now supported with the arrival of the extension in the Windows Store. The extension is compatible with the current version of Microsoft Edge (34+) as well as the preview version available at Microsoft Edge Insider.

The extension displays a website's hosting provider, country, longevity and popularity, along with an abstracted risk rating for each site. Its key features are:

• Protection against phishing sites — the Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, Netcraft blocks it for all users of the extension, providing an additional level of protection from phishing. Netcraft processes reports of fraudulent URLs from a variety of sources and proactively searches for new fraudulent sites.
• Detailed site reports — simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.
• Risk ratings — we evaluate the characteristics of the site compared against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.
• Convenient reporting for suspected phishing & fraudulent sites — at the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for phishing site submissions, including iPads, backpacks, mugs, and more. As of July 2019, over 65 million phishing sites have been detected and blocked by Netcraft since its anti-phishing service was launched.
• Protection against cross site scripting (XSS) — the extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.

Left: Microsoft Edge without the Extension - Right: The Netcraft Extension blocking page

The extension is now available to download from the Microsoft Store and once installed will automatically start blocking malicious sites. It is also available from the Google Chrome Store, Opera add-ons page and the Firefox add-ons page.

Netcraft has also released apps for iOS and Android, which protect your mobile device from phishing attacks.