{"id":1532898,"date":"2025-02-10T16:39:08","date_gmt":"2025-02-10T18:39:08","guid":{"rendered":"https:\/\/teknomers.com\/fr\/les-pirates-exploitent-google-tag-manager-pour-deployer-des-skimmers-de-carte-de-credit-dans-les-magasins-magento\/"},"modified":"2025-02-10T16:39:13","modified_gmt":"2025-02-10T18:39:13","slug":"les-pirates-exploitent-google-tag-manager-pour-deployer-des-skimmers-de-carte-de-credit-dans-les-magasins-magento","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/les-pirates-exploitent-google-tag-manager-pour-deployer-des-skimmers-de-carte-de-credit-dans-les-magasins-magento\/","title":{"rendered":"Les pirates exploitent Google Tag Manager pour d\u00e9ployer des skimmers de carte de cr\u00e9dit dans les magasins Magento"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">10 f\u00e9vrier 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">S\u00e9curit\u00e9 de logiciels malveillants \/ paiement<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/Les-pirates-exploitent-Google-Tag-Manager-pour-deployer-des-skimmers.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Les acteurs de la menace ont \u00e9t\u00e9 observ\u00e9s en tirant parti de Google Tag Manager (GTM) pour livrer des sites Web de logiciels malveillants de la carte de cr\u00e9dit ciblant les sites Web de commerce \u00e9lectronique bas\u00e9s sur Magento.<\/p>\n<p>Soci\u00e9t\u00e9 de s\u00e9curit\u00e9 de site Web SUCURI <a rel=\"noopener nofollow\" href=\"https:\/\/blog.sucuri.net\/2025\/02\/google-tag-manager-skimmer-steals-credit-card-info-from-magento-site.html\" target=\"_blank\">dit<\/a> Le code, tout en semblant \u00eatre un script GTM et Google Analytics typique utilis\u00e9 \u00e0 des fins d&#8217;analyse et publicit\u00e9 de sites Web, contient une porte d\u00e9rob\u00e9e obscurcie capable de fournir aux attaquants un acc\u00e8s persistant.<\/p>\n<p>Au cours de l&#8217;\u00e9criture, autant que <a rel=\"noopener nofollow\" href=\"https:\/\/publicwww.com\/websites\/%22GTM-MLHK2N68%22\/\" target=\"_blank\">Trois sites<\/a> Il a \u00e9t\u00e9 constat\u00e9 \u00eatre infect\u00e9 par l&#8217;identifiant GTM (GTM-MLHK2N68) en question, contre six rapport\u00e9s par Sucuri. L&#8217;identifiant GTM fait r\u00e9f\u00e9rence \u00e0 un <a rel=\"noopener nofollow\" href=\"https:\/\/support.google.com\/tagmanager\/answer\/14847097?hl=en\" target=\"_blank\">r\u00e9cipient<\/a> Cela inclut les diff\u00e9rents codes de suivi (par exemple, Google Analytics, Facebook Pixel) et les r\u00e8gles \u00e0 d\u00e9clencher lorsque certaines conditions sont remplies.<\/p>\n<p>Une analyse plus approfondie a r\u00e9v\u00e9l\u00e9 que les logiciels malveillants sont charg\u00e9s de la table de base de donn\u00e9es Magento &#8220;CMS_BLOCK.Content&#8221;, avec la balise GTM contenant une charge utile JavaScript cod\u00e9e qui agit comme un \u00e9cumoire de carte de cr\u00e9dit.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a rel=\"nofollow noopener sponsored\" href=\"https:\/\/thehackernews.uk\/saas-security-v1-d\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybers\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/1738390842_400_Meta-confirme-lattaque-de-logiciels-spyware-zero-clique.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>&#8220;Ce script a \u00e9t\u00e9 con\u00e7u pour collecter des donn\u00e9es sensibles entr\u00e9es par les utilisateurs pendant le processus de paiement et l&#8217;envoyer \u00e0 un serveur distant contr\u00f4l\u00e9 par les attaquants&#8221;, a d\u00e9clar\u00e9 Puja Srivastava, chercheur en s\u00e9curit\u00e9.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/1739212748_340_Les-pirates-exploitent-Google-Tag-Manager-pour-deployer-des-skimmers.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/1739212748_340_Les-pirates-exploitent-Google-Tag-Manager-pour-deployer-des-skimmers.png\" alt=\"\" border=\"0\" data-original-height=\"1100\" data-original-width=\"1944\"\/><\/a><\/div>\n<p>Lors de l&#8217;ex\u00e9cution, le malware est con\u00e7u pour piloter les informations de carte de cr\u00e9dit \u00e0 partir des pages de paiement et l&#8217;envoyer \u00e0 un serveur externe.<\/p>\n<p>Ce n&#8217;est pas la premi\u00e8re fois que GTM est maltrait\u00e9 \u00e0 des fins malveillantes. En avril 2018, SUCURI <a rel=\"noopener nofollow\" href=\"https:\/\/blog.sucuri.net\/2018\/04\/malicious-activities-google-tag-manager.html\" target=\"_blank\">r\u00e9v\u00e9l\u00e9<\/a> que l&#8217;outil \u00e9tait en train d&#8217;\u00eatre exploit\u00e9 \u00e0 des fins de malvertisation.<\/p>\n<p>Le d\u00e9veloppement intervient des semaines apr\u00e8s l&#8217;entreprise <a rel=\"noopener nofollow\" href=\"https:\/\/blog.sucuri.net\/2025\/01\/malware-redirects-wordpress-traffic-to-harmful-sites.html\" target=\"_blank\">d\u00e9taill\u00e9<\/a> Une autre campagne WordPress qui a probablement utilis\u00e9 des vuln\u00e9rabilit\u00e9s dans les plugins ou des comptes d&#8217;administration compromis pour installer des logiciels malveillants qui ont redirig\u00e9 les visiteurs du site vers des URL malveillants.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant? Suivez-nous <a rel=\"noopener nofollow\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Gazouillement <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"noopener nofollow\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">Liendin<\/a> Pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/hackers-exploit-google-tag-manager-to.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80210 f\u00e9vrier 2025\ue804Ravie LakshmananS\u00e9curit\u00e9 de logiciels malveillants \/ paiement Les acteurs de la menace ont \u00e9t\u00e9 observ\u00e9s en tirant parti de Google Tag Manager (GTM) pour livrer des sites Web de logiciels malveillants de la carte de cr\u00e9dit ciblant les sites Web de commerce \u00e9lectronique bas\u00e9s sur Magento. Soci\u00e9t\u00e9 de s\u00e9curit\u00e9 de site Web SUCURI [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1532899,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[274266,274265,938,4168,49,79002,274264,4161,274263,6124,429,9886,133,8736,7755,65,6118,166429,274267,7842,4160,4394,185,238617,246491,4172,249580,69348,79016,4166,4164],"class_list":["post-1532898","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-actualites-de-piratage","tag-actualites-des-pirates","tag-carte","tag-comment-pirater","tag-credit","tag-cyber-security-news","tag-cyber-security-news-aujourdhui","tag-cyber-mises-a-jour","tag-cyber-nouvelles","tag-cyberattaques","tag-dans","tag-deployer","tag-des","tag-exploitent","tag-google","tag-les","tag-magasins","tag-magento","tag-malware-ransomware","tag-manager","tag-mises-a-jour-de-la-cybersecurite","tag-pirates","tag-pour","tag-securite-de-linformation","tag-securite-du-reseau","tag-securite-informatique","tag-skimmers","tag-tag","tag-the-hacker-news","tag-violation-de-donnees","tag-vulnerabilite-logicielle"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1532898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=1532898"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1532898\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/1532899"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=1532898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=1532898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=1532898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}