fawn | #RENEWTHECUPHEADSHOW
@rollindice.bsky.social
97 followers 92 following 42 posts
icon comms open! • fawn/cupid/dice • 21 • he/were/wolf • nft/proship/dsmp/etc DNI ‼️ • that weird cuphead and werewolf mutual
icon comms open! • fawn/cupid/dice • 21 • he/were/wolf • nft/proship/dsmp/etc DNI ‼️ • that weird cuphead and werewolf mutual
![Go to bapccanada
r/bapccanada
•
2h ago
Extension-Fly1044
Canada Computers online card skimmer
If you have made a purchase recently on Canada Computers' online store, you should immediately freeze or cancel the card you used.
I found a card skimmer on Canada Computers' online checkout page. This malware steals any information you enter on the page and sends it to the attacker's website.
The malware is a Magecart-style script that listens for keystrokes on input fields, validates them, and steals them. It's obfuscated and loads from CodePen through a disguised Google Analytics script (something a real payment processor would never do). The malware captures credit card number, CVV, expiration date, first name, last name, billing address, billing city, billing province, billing postal code, phone number and email address.
I found this on January 18th when buying something on the website with DevTools open. I saw a suspicious WebSocket connection to rozenfeld[.]xyz. This domain isn't related to Canada Computers or any payment processor in any way. It looks similar to rozenfeld[.]ca, which I believe is a legitimate e-commerce related company. This could be an attempt from the attackers to seem legitimate.
Keep in mind I'm just a person who does web development as a hobby, I'm not a cybersecurity expert. I have opened two support tickets with them via email to try and tell them about this privately and they have closed both with no response. I'm assuming this is because they thought it was a scam or prank. I'm posting this publicly because they're closing my support requests and because the skimmer is still on the website, stealing data.
I have frozen my card that was stolen and have reported this to the Canadian Anti-Fraud Centre.
Evidence:
Screenshot of WebSocket connection messages: https://i.imgur.com/NPMff8y.png
Screenshot of WebSocket connection details: https://i.imgur.com/Sve5gZ7.png
Screenshot of two closed tickets: https://i.imgur.com/RsUhvVs.png](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:zug3xiilxtouicdnbxromksq/bafkreih3qbevlxeqbm3xxtejohj6xguh5xoypk5zd2xksdbmgx6dzaokv4)
