Payment Card Data Stolen Using Fake Font Domain in WordPress Malware Attack
Published on April 11, 2025
- WordPress websites are again targeted by card skimmers compromising the checkout page.
- This time, the infection involved a malicious script linked to a non-indexed website.
- The domain was associated with a fake payment form that exfiltrated sensitive card details in real time.
A malicious campaign targeted WordPress websites, which involved a fake font domain designed to skim credit card data from unsuspecting users according to a recent investigation by security researchers at Sucuri.
The case began when a WordPress website owner noticed an unusual spike in credit card fraud reports from their customers after purchases. Upon investigation, it was discovered that the website's checkout page was compromised by a suspicious script linked to the domain italicfonts[.]org.Â
At first glance, the domain seemed legitimate, mimicking a site offering font resources. However, further analysis revealed it was designed specifically for malicious purposes.
![Injecting the malicious domain italicfonts[.]org into the site](https://cdn.technadu.com/wp-content/uploads/2025/04/Injecting-the-malicious-domain-italicfonts.org-into-the-site-1024x347.png)
![Injecting the malicious domain italicfonts[.]org into the site](https://cdn.technadu.com/wp-content/uploads/2025/04/Injecting-the-malicious-domain-italicfonts.org-into-the-site.png)
The attackers embedded a heavily obfuscated script into the site's footer.php file, recently modified to include the malicious domain. The script executed once users accessed the checkout page.
The injected code built a convincing credit card input field disguised as a legitimate payment form. This fake form was positioned strategically to collect billing information without raising suspicion.
The script captured sensitive payment details in real time, including card numbers, expiration dates, CVV codes, and billing addresses. These details were then exfiltrated to the attacker’s remote server hosted on the fake font domain, making it appear innocuous to automated security checks.
Three key indicators confirmed the malicious nature of italicfonts[.]org – recently registered domain, lack of indexed results, and presence in a fraudulent form.
Attackers commonly employ newly registered domains to avoid detection. The absence of indexed pages for the domain on search engines was a red flag. The domain's association with the fake payment form demonstrated its purpose as part of the skimming operation.
Related
Most Popular
Most Popular