Hackers have learned to fake 404 errors in online stores to steal money

Akamai Security Intelligence Group specialists discovered A new way to steal user credit card data is by spoofing 404 error pages in online stores.

As it turned out, attackers successfully change the default settings for the entire site and thus hide malicious code. The fake form asks site visitors to enter their credit card number, expiration date, and security code. After this, the system issues a “session timeout”. At the same time, all information is encoded in base64 format and sent to third parties.

This is one of three methods. The other two involve hiding the code in the "onerror" attribute of an image's HTML tag, and simulating a Meta Pixel code snippet in the image's binary code.