Cyberattack hits European Space Agency’s online store, payment card data stolen

[swidup]

https://www.techmonitor.ai/technology/cybersecurity/cyberattack-esa-online-store-payment-card-data-stolen

"The European Space Agency’s (ESA) official web shop has fallen victim to a cyberattack, resulting in the theft of customer payment card details during transactions. The breach, identified by e-commerce security firm Sansec, involved a malicious JavaScript code embedded into the store’s checkout process, redirecting customers to a counterfeit payment page.

Malicious script redirects customers to fake payment page
The fake payment page, which mimicked a legitimate Stripe interface, was served directly from ESA’s web shop, making it appear authentic to unsuspecting users. The attack exploited domain spoofing, using a near-identical domain name. While ESA’s official shop operates under “esaspaceshop.com,” the attackers employed “esaspaceshop.pics,” leveraging a different top-level domain to deceive visitors."