Cloud CMS is a cloud-hosted content management system that allows users and companies to host a website on the company’s servers, e.g WordPress, wix, weebly, Blogger etc . It appears that hackers have breached this Cloud CMS and have modified one of the Alpaca Form scripts.
Currently, it is unknown how the hackers violated Picreel or the Alpaca forms. In a twitter conversation, de Groot told ZDNet the hack appears to have been carried out by the same threat actor.
Some group of hackers have hacked third-party companies to deploy cryptojacking scripts, while others have used the same technique to deeply specialized code that steals data entered in payments forms.
The malicious code records all the content that users enter in the fields of the form which includes payment pages, contact forms and login sections and sends the information to a server located in Panama.
The malicious code embedded in the Picreel script has been seen on 1,249 websites, while the one hosted on the cloud CMS infrastructure has been seen on 3,455 domains.
Update: Minutes after this article’s publication, we were notified that those malicious codes has been removed from the cloud CMS infrastructure.