Skimming Malware Exposes Vulnerabilities in Five Billion-Dollar Companies Within Two Months

Recent findings have revealed that skimming malware has infiltrated the websites of several multi-billion-dollar companies, raising significant concerns about data security. The critical question is not merely what data was compromised but how such vulnerabilities were exploited in the first place.

Planning for a Breach You Might Not See

In March, researchers from the Dutch cybersecurity firm Sansec uncovered a sophisticated payment skimmer on the online store of a car manufacturer with revenues exceeding $100 billion. While skimming attacks are not new, this particular instance was noteworthy for its use of WebRTC, a peer-to-peer protocol typically employed for video calls. This method of data exfiltration deviates from conventional web requests, complicating detection and prevention efforts.

The choice of WebRTC is crucial. Traditional security measures, such as Content Security Policies (CSPs) and web application firewalls (WAFs), are designed to monitor inbound HTTP traffic. However, WebRTC operates on an outbound basis, creating a direct connection from the browser to the attacker, effectively bypassing many existing security controls.

The Tactic Changes; The Gap Does Not

The March attack highlights a persistent issue in cybersecurity: the evolution of tactics without a corresponding enhancement in defensive measures. While WebRTC is a newer method for data exfiltration, the underlying problem of unauthorized data transfer remains unchanged.

In the weeks following the Sansec report, attackers have leveraged WebRTC nodes to execute supply-chain malware, demonstrating the versatility of this approach. Additionally, researchers have illustrated that AI sandboxes can be manipulated to leak sensitive documents over DNS when their HTTP pathways are blocked. This underscores the need for organizations to reassess their security investments and focus on areas that provide the most effective protection.

Defenders face a daunting challenge. Prevention strategies can only address known vulnerabilities, making it imperative to adopt a mindset that anticipates failure. Organizations must be prepared for the possibility that data will eventually be exfiltrated, regardless of the channel used.

Strategies for Effective Defense

To mitigate the risks associated with potential breaches, organizations should invest in proactive strategies such as:

• Integrity Monitoring: Implementing systems to track changes on sensitive pages can help identify unauthorized modifications.
• Anomaly Detection: Monitoring data leaving the network can reveal unusual patterns that may indicate a breach.

These approaches enable organizations to answer critical questions, such as whether a webpage has changed from its original state and if data is exiting through atypical channels. With adequate planning, these questions can be addressed without prior knowledge of the attacker’s methods.

The Legal Turn

The implications of cybersecurity breaches extend beyond technical failures; they also encompass legal responsibilities. In February 2026, the Federal Court ordered FIIG Securities to pay $2.5 million in civil penalties for violating section 912A of the Corporations Act over a four-year period. This marked the first civil penalty for cybersecurity failures under general financial services licensee obligations.

A key takeaway from the court’s ruling is that a successful cyberattack does not automatically signify a failure to meet obligations. Justice Derrington emphasized that preventing every attack is nearly impossible. The court’s finding against FIIG was based not on the breach itself but on inadequate risk management and monitoring systems, as well as the inconsistent implementation of required controls.

The court mandated that organizations must manage risks effectively and be capable of detecting and responding to incidents. This distinction aligns with the technical challenges posed by WebRTC: while prevention may eventually falter, it is increasingly likely that courts or insurers will scrutinize whether adequate strategies were in place to identify and respond to failures.

Broader Implications for the Industry

The principles established in the FIIG case are not limited to financial services. Analysts have noted that the inadequacies identified were treated as failures of general statutory duty, not merely breaches of specific cybersecurity standards. The Notifiable Data Breaches scheme and recent privacy reforms further complicate matters. Organizations unable to ascertain what data was compromised face dual challenges: a notification obligation they cannot fulfill and a lack of evidence demonstrating that reasonable precautions were taken beforehand.

Investing in cybersecurity remains a more manageable option than facing the financial and legal repercussions of a breach. Whether it involves cardholder data or medical records, the unseen activities of skimmers can lead to breaches that are increasingly difficult to defend against, both technically and legally.

In conclusion, the evolving landscape of cybersecurity threats necessitates a proactive approach to risk management. Organizations must prioritize strategies that enhance their ability to detect and respond to breaches, ensuring compliance with legal obligations while safeguarding sensitive data.

Source: www.cyberdaily.au

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.