Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?


Application Security

Target Open Sources Web Skimmer Detection Tool

Retail giant Target this week announced the open source availability of an internal tool designed for the detection of web skimming attacks.

Retail giant Target this week announced the open source availability of an internal tool designed for the detection of web skimming attacks.

Dubbed Merry Maker, the tool analyzes payment page code served to users and network traffic from test payment transactions to identify any malicious indicators. The company says it has been using the tool since 2018 to perform more than one million website scans.

In addition to simulating a real site visitor and saving the generated code and network activity for analysis, the utility searches for new and known malicious domains and creates an alert when any is identified. The tool supports Basic, Kafka, and GoAlert alerts.

[READ: New Open Source Tool Helps Identify EtherNet/IP Stacks for ICS Research]

“Merry Maker continually simulates online browsing and completes test transactions to scan for the presence of malicious code. Merry Maker acts like a guest on by completing several typical activities including online purchases. While doing so, the tool gathers and analyzes a variety of information including network requests, JavaScript files, and browser activity to determine if there’s any type of unwanted activity,” Target explains.

All purchases made by Merry Maker are flagged as tests internally and are not processed, but all other operations are performed just as they would normally be during checkout.

The tool can also help identify data exfiltration attempts by running Yara rules, which also allows it to detect credit card numbers or specific data. Furthermore, it can capture the Document Object Model (DOM) state at any moment.

Merry Maker, which uses Puppeteer and Headless Chrome, was open sourced alongside several detection rules, but Target says the tool also allows for the addition of new detections via Typescript.

Advertisement. Scroll to continue reading.

Related: Google, Adobe Announce New Open Source Security Tools

Related: RPC Firewall Dubbed ‘Ransomware Kill Switch’ Released to Open Source

Related: New Google Tool Helps Developers Visualize Dependencies of Open Source Projects

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights