Malware

FakeSecurity

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

If the website administrator’s computer was successfully infected, attackers used the administrator’s credentials to obtain access to the admin panel of e-commerce CMS in order to install a JS-sniffer

Execution

1 technique

T1059.007JavaScriptEvidence1

While attacking websites, attackers injected a malicious code into the website’s source code.

Persistence

1 technique

T1078Valid AccountsEvidence1

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

The script runs every time that a victim browses an online shop. It steals user payment information during checkout and sends it to the attacker’s server.

Collection

1 technique

T1056.001KeyloggingEvidence1

The script runs every time that a victim browses an online shop. It steals user payment information during checkout and sends it to the attacker’s server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

16 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

group ibNews

Sep 9, 2025

The footprints of Raccoon | Group-IB Blog

A JavaScript payment-card skimmer/sniffer family used to infect online stores, obfuscated with aaencode, and assessed by the report as likely operated by the same actors behind the stealer distribution campaign.

group ibNews

Sep 8, 2025

Massive malicious campaign by FakeSecurity JS-sniffer | Group-IB Blog

A JavaScript web skimmer used against Magento-based e-commerce sites. Attackers injected the malicious script into website source code so it executed during checkout, stole payment information, and sent the data to attacker-controlled servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

FakeSecurity

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Execution

1 technique

T1059.007JavaScriptEvidence1

While attacking websites, attackers injected a malicious code into the website’s source code.

Persistence

1 technique

T1078Valid AccountsEvidence1

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Stealth

1 technique

T1078Valid AccountsEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

The script runs every time that a victim browses an online shop. It steals user payment information during checkout and sends it to the attacker’s server.

Collection

1 technique

T1056.001KeyloggingEvidence1

The script runs every time that a victim browses an online shop. It steals user payment information during checkout and sends it to the attacker’s server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

10 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

16 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

group ibNews

Sep 9, 2025

The footprints of Raccoon | Group-IB Blog

group ibNews

Sep 8, 2025

Massive malicious campaign by FakeSecurity JS-sniffer | Group-IB Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching27

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.