Cyber Incident Victim: Picreel
Date:
May 2019
Location:
Panama
Summary
Hackers compromised servers of multiple companies, including Picreel, to inject malicious scripts across thousands of websites, aiming to capture all user input entered into form fields—such as payment details, passwords, and contact information—and exfiltrate it to a Panama-based server. The attack leveraged supply-chain tactics by targeting providers of secondary website code, with some compromised scripts failing to execute due to coding errors or limited deployment scope. While one affected third-party service provider disabled its compromised content delivery network, investigations found no direct breach of its infrastructure. The incident highlighted a broader trend of attacks exploiting third-party dependencies to harvest sensitive data indiscriminately from diverse website forms.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The incident involving Picreel emerged on May 12, 2019, as part of a broader campaign targeting multiple online service providers. Security researcher Willem de Groot of Sanguine Security initially identified malicious scripts on servers belonging to Picreel and Alpaca Forms, with RiskIQ researchers subsequently confirming similar compromises at five additional companies: AppLixir, RYVIU, OmniKick, eGain, and AdMaxim. Attackers breached at least seven companies to inject malicious code into their services, which were then delivered to approximately 4,600 customer websites. The compromised scripts were designed to capture all data entered into website form fields—including payment details, login credentials, and contact information—and exfiltrate it to a server located in Panama. This ongoing attack remained active at the time of initial reporting, with malicious scripts still operational across affected sites.
The campaign represented a significant escalation in supply-chain attacks due to its indiscriminate targeting of all form fields across websites, unlike previous incidents that focused on specific data types like payment information. While Cloud CMS intervened to disable the compromised CDN hosting Alpaca Forms' script, they clarified their infrastructure wasn't directly breached but rather exploited through customer implementations. Picreel experienced a failed execution attempt, as attackers' flawed code modifications prevented the malicious payload from activating on their platform—a similar outcome occurred with OmniKick. eGain's compromise was limited to scripts running exclusively on their own website rather than customer-facing implementations. The incident highlighted attackers' strategic shift toward compromising third-party service providers to maximize the scale of data harvesting from downstream websites.