Summary

Caramel is a credit card skimmer, and yet another piece that plays into the business end of cybercrime. The code they sell is made to insert into legitimate sites that have been compromised. When someone uses the site to make a legitimate purchase, the skimmer sends copies of the credit card information to the cybercriminal. The card information can then be used by the cybercriminal directly or sold on the dark web.

Caramel is not cheap, but the key to their value is their customer service. The code used to skim credit cards is just the tip of the iceberg. The providers also include instructions, a management dashboard, upgrades, tips to avoid detection, and active customer support. It is truly credit card skimming as a service.

1. Look for the https and lock symbol when making an online purchase. These are basic security markers and should be present anytime you give valuable information online.
2. Purchase from either a big-name retailer or a smaller retailer who uses a big-name processor you recognize. These are most likely to have patches for any known vulnerabilities for skimmers like Caramel.
3. Use a virtual credit card. This is a one-time use number issued by your existing credit card company that cannot be reused in case the credentials are stolen. Methods of accessing these vary by credit card company, but often they are found within your account website under “tools” and “secure online account numbers” or “virtual card.”
4. Keep an eye on credit card statements and obtain your annual free credit reports. This will allow you to freeze your credit and change cards if one of yours is somehow stolen.

Want To Know More?

Get more details about Caramel from Bleeping Computer’s original post.