Loading story…
Silent Push reported a large-scale Magecart-style web-skimming operation active since early 2022 that uses an extensive domain network to support client-side JavaScript skimmers on compromised e-commerce checkout pages. The activity is assessed to impact online shoppers and organizations that are clients of major payment providers, with targeting noted against American Express, Diners Club, Discover, JCB, Mastercard, and UnionPay; the skimmers are designed to quietly exfiltrate payment-card and other form data during transactions rather than disrupt systems.
Technical reporting tied the infrastructure to domains hosting highly obfuscated skimmer payloads (e.g., recorder.js, tab-gtm.js) and described evasion logic that attempts to avoid execution when site administrators are present (e.g., checking the DOM for WordPress’ wpadminbar). The infrastructure analysis also linked parts of the campaign to a domain associated with the sanctioned bulletproof hosting ecosystem around Stark Industries / PQ.Hosting, which has been described as rebranding to THE[.]Hosting under WorkTitans B.V., consistent with sanctions-evasion behavior; researchers emphasized that weak third-party script governance on payment pages remains a key enabling factor for this type of long-lived skimming operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Silent Push disclosed that the operation had been active since early 2022 and described its malicious domain network, skimmer behavior, and data theft methods affecting multiple major payment brands. The researchers also linked supporting infrastructure to Stark Industries/PQ.Hosting, which they said had rebranded to THE.Hosting under WorkTitans B.V.
The campaign used highly obfuscated JavaScript on compromised WooCommerce and Stripe checkout flows, replacing legitimate payment forms with fake ones to capture card details before showing an error. The malware also used conditional activation, self-removal when the WordPress admin bar was detected, and anti-repeat logic to reduce detection.
A large-scale web skimming operation became active by January 2022, compromising online checkout pages to steal payment card and personal data from shoppers. The campaign targeted merchants, payment portals, and third-party payment processors tied to major card networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
A long-running **Magecart** operation linked to the **ATMZOW** skimmer family abused **Google Tag Manager (GTM)** to inject credit-card theft code into compromised ecommerce checkout pages, according to Sucuri. The attackers hid malicious JavaScript inside GTM containers served through `googletagmanager.com`, exploiting the trust many sites place in that domain while using multi-stage obfuscation to steal payment data. Sucuri said the activity affected hundreds of sites, with one malicious container, `GTM-WJV6J6`, detected 178 times before removal, and tied the campaign to Magento-focused compromises dating back to the 2015 **Guruincsite** infections. Researchers said the operators rotated payload delivery through about 40 newly registered lookalike domains, used **Cloudflare** to shield infrastructure, and stored selected domains in browser local storage to complicate analysis and blocking. After Google removed malicious containers such as `GTM-WJ6S9J6` and `GTM-TVKQ79ZS`, the attackers quickly replaced them with new IDs including `GTM-NTV2JTB4` and `GTM-MX7L8F2M`, showing persistent reinfection efforts; in at least one case, the GTM-based skimmer ran alongside a separate WebSocket-based skimmer, indicating overlapping compromises and continued adaptation by the threat actor.
Jun 29, 2026
A series of sophisticated cyberattacks have targeted online payment systems and e-commerce users through phishing emails, malicious browser extensions, and large-scale web skimming operations. One campaign impersonated WordPress.com, sending convincing domain renewal emails that redirected victims to a fake payment portal designed to steal credit card details and 3-D Secure OTPs, with exfiltration occurring via Telegram. Another operation involved over 50 malicious scripts injected into checkout and account creation flows on e-commerce sites, using modular payloads tailored for specific payment processors like Stripe, PayPal, and Mollie, and leveraging fake domains to evade detection. In parallel, threat actors have deployed malicious browser extensions across Chrome, Edge, and Firefox, impacting millions of users by hijacking search queries, stealing data, and committing affiliate fraud. These extensions often remain dormant for extended periods before being weaponized through updates, further complicating detection. Collectively, these campaigns demonstrate a significant evolution in cybercriminal tactics, blending phishing, web skimming, and browser-based attacks to compromise sensitive financial and personal information at scale.
Jun 29, 2026