Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

Target Open Sources Web Skimmer Detection Tool

Retail giant Target this week announced the open source availability of an internal tool designed for the detection of web skimming attacks.

Retail giant Target this week announced the open source availability of an internal tool designed for the detection of web skimming attacks.

Dubbed Merry Maker, the tool analyzes payment page code served to users and network traffic from test payment transactions to identify any malicious indicators. The company says it has been using the tool since 2018 to perform more than one million website scans.

In addition to simulating a real site visitor and saving the generated code and network activity for analysis, the utility searches for new and known malicious domains and creates an alert when any is identified. The tool supports Basic, Kafka, and GoAlert alerts.

[READ: New Open Source Tool Helps Identify EtherNet/IP Stacks for ICS Research]

“Merry Maker continually simulates online browsing and completes test transactions to scan for the presence of malicious code. Merry Maker acts like a guest on by completing several typical activities including online purchases. While doing so, the tool gathers and analyzes a variety of information including network requests, JavaScript files, and browser activity to determine if there’s any type of unwanted activity,” Target explains.

All purchases made by Merry Maker are flagged as tests internally and are not processed, but all other operations are performed just as they would normally be during checkout.

The tool can also help identify data exfiltration attempts by running Yara rules, which also allows it to detect credit card numbers or specific data. Furthermore, it can capture the Document Object Model (DOM) state at any moment.

Merry Maker, which uses Puppeteer and Headless Chrome, was open sourced alongside several detection rules, but Target says the tool also allows for the addition of new detections via Typescript.

Related: Google, Adobe Announce New Open Source Security Tools

Related: RPC Firewall Dubbed ‘Ransomware Kill Switch’ Released to Open Source

Related: New Google Tool Helps Developers Visualize Dependencies of Open Source Projects

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Application Security

While there are many routes to application security, bundles that allow security teams to quickly and easily secure applications and affect security posture in...

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.