A prominent online seller of e-cigarettes and vaping kits is serving a credit card skimmer on its live site, likely after getting hacked.
With its presence across the U.S. and Canada, Element Vape sells e-cigarettes, vaping devices, e-liquids, and CBD products in both retail outlets and on their online store.
Threat actors employing such credit card stealers on eCommerce stores by injecting scripts are referred to as Magecart.
Multiple webpages of the store, starting with the homepage, contain an obscure base64-encoded script that can be seen on lines 45-50 of the HTML source code shown below.
It isn’t exactly known for how long has the malicious script been present on ElementVape.com.
Our analysis of ElementVape.com on Wayback Machine indicates the above code was absent as of February 5th 2022 and before. Therefore, the infection appears to be more recent, occurring sometime after the date and before getting discovered today.
Script exfiltrates payment data via Telegram
The above script, when decoded and analyzed by BleepingComputer, was seen collecting customers’ payment card and billing information on checkout.
Some of the fields that the script looks for include: email address, payment card number/expiration date, phone number, billing address including street and ZIP code.
This information is then exfiltrated to the attacker via an obfuscated, hardcoded Telegram address present in the script
Further, the script contains anti-reverse-engineering features that check if it is being run in a sandbox environment or “devtools” to deter analysis.
Large but obscure e-cig retailer
It isn’t clear how ElementVape.com’s backend code was malicously modified in the first place to sneak in the malicious script.
And, this is not the first time Element Vape has been compromised either.
In 2018, Element Vape customers reported receiving letters from the company stating that a data breach had occurred and the “window of intrusion between Dec 6, 2017 and June 27, 2018” potentially exposed customers’ personal information to threat actors. Element Vape confirmed the claims via what appears to be the company’s Reddit account.
Following this event, Illinois-based consumer Artur Tyksinski sued Element Vape alleging that the vaping retailer “failed to timely notify affected individuals of the data breach” and didn’t have adequate procedures in place to prevent unauthorized access to customers’ confidential information. This was followed by a class-action lawsuit in 2019, demanding a trial by jury.
Despite supposedly being “one of the world’s largest online Vape retailers” of e-cigarettes across retail stores and online, not much is readily known about Element Vape.
Known as TheSY LLC in some states, Element Vape’s Twitter account shows a following of more than 13,000 users.
But, oddly enough, their tweets are protected, making it harder to interact with the retailer.