Segway website hacked and infected with payment card skimmer

Hackers have breached the Segway website and placed malicious code on its online store to collect payment card details from online shoppers.

"The website was compromised at least since January 6th," antivirus maker Malwarebytes said on Monday.

The security firm said the attack was still ongoing at the time it published its blog post and security alert.

A Segway spokesperson did not return a request for comment. A Malwarebytes spokesperson told The Record the site was still compromised at the time of writing.

In a technical report on Monday, Malwarebytes said the attackers breached Segway's Magento-based online store and then added a piece of JavaScript to the site that loaded malicious code from the booctstrap[.]com domain.

This code would activate when users would visit the store's checkout page, collect information entered in the payment form, and send the data to a remote server.

The Malwarebytes Threat Intelligence Team said they linked the code to a threat actor known as Magecart Group 12.

Active since September 2018, this threat actor has been linked to several security incidents, including the compromise of Adverline, a French advertising agency, from where it used its ads to place card-stealing code on hundreds of other sites and the hack of re-seller of tickets for the Tokyo Olympics.

Based on its telemetry data, Malwarebytes said that most users who visited the compromised Segway site during the past three weeks were based in Australia and the US.