Loading story…
A series of sophisticated cyberattacks have targeted online payment systems and e-commerce users through phishing emails, malicious browser extensions, and large-scale web skimming operations. One campaign impersonated WordPress.com, sending convincing domain renewal emails that redirected victims to a fake payment portal designed to steal credit card details and 3-D Secure OTPs, with exfiltration occurring via Telegram. Another operation involved over 50 malicious scripts injected into checkout and account creation flows on e-commerce sites, using modular payloads tailored for specific payment processors like Stripe, PayPal, and Mollie, and leveraging fake domains to evade detection.
In parallel, threat actors have deployed malicious browser extensions across Chrome, Edge, and Firefox, impacting millions of users by hijacking search queries, stealing data, and committing affiliate fraud. These extensions often remain dormant for extended periods before being weaponized through updates, further complicating detection. Collectively, these campaigns demonstrate a significant evolution in cybercriminal tactics, blending phishing, web skimming, and browser-based attacks to compromise sensitive financial and personal information at scale.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers documented a phishing campaign impersonating WordPress.com domain renewal notices, directing victims to a fake payment portal at soyfix[.]com. The operation stole credit card details and 3-D Secure OTPs, exfiltrating them via Telegram while using Alibaba Cloud-linked mail infrastructure and spoofing-friendly email conditions.
Source Defense Research identified a global web-skimming operation using more than 50 malicious scripts against e-commerce sites. The campaign harvested payment card data, customer identities, credentials, and email addresses through checkout and account-creation flows using localized payloads and deceptive infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
malwr-analysis.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported widespread **web skimmer** activity targeting e-commerce sites, where attackers injected malicious JavaScript into checkout pages to steal payment-card data and send it to attacker-controlled command-and-control infrastructure. Analysis of **351,972 compromised HTML pages** across **6,684 unique domains** found the activity was globally distributed, with the highest concentration of affected domains in the **United States**. The investigation identified **10,764 unique malicious JavaScript snippets** grouped into **63 malware families**, with a small number of families driving most of the observed activity. A closer look at one representative cluster, **`family7`**, showed heavy code variation, obfuscation, and frequent infrastructure changes, including domains such as `informaer[.]net`, `cloudservice[.]tw`, and `onlinestatus[.]site`, underscoring how polymorphic skimmer campaigns evade static detection and persist on poorly maintained web platforms.
Aug 15, 2026
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Threat researchers reported multiple financially motivated social-engineering operations designed to steal credentials and enable downstream fraud. Malwarebytes documented a **job-themed phishing** campaign impersonating *Google Forms* via the lookalike domain `forms.google.ss-o[.]com`, using a `generation_form.php` script to generate personalized lure URLs and redirecting victims through a fake form to a credential-harvesting login flow (e.g., `id-v4[.]com`). The infrastructure also used redirection to local Google search pages as an anti-analysis tactic to reduce link sharing and researcher visibility. Separately, Bridewell-reported activity described a **Booking.com-themed, multi-stage phishing and fraud scheme** targeting both hotel partners and guests: initial “complaint”/reservation lures drive staff to attacker-controlled portals using lookalike domains (including **IDN homograph** tricks) to harvest partner credentials, followed by account takeover and guest-facing fraud (including WhatsApp outreach using real booking details). A third report described the broader rise of **Carding-as-a-Service (CaaS)** marketplaces (e.g., “fullz” bundling and platforms such as Findsome and UltimateShop) and the supply chain feeding them (PhaaS credential theft, skimming, and malware), but it did not describe the same specific phishing incidents and should be treated as related background rather than part of the same event.
Jun 29, 2026