Loading story…
Researchers detailed a Magecart-style web skimmer planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used anti-debugging, adaptive field mapping, and localStorage persistence to evade detection and maintain access, with reported indicators including gstatis.co and 185.215.113.111.
Separate reporting on a major Japanese case described a similar web skimming intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than 100,000 records. Analysts said Content Security Policy (CSP) would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to www.javascriptworld.xyz/isSafe.php, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Pi Mobile activated its incident response process, engaged a third-party forensic firm, and reported the matter to regulators. The company said it would notify affected users once the scope of any exposure is confirmed.
Taiwan’s Administration for Digital Industries opened an inspection under the Personal Data Protection Act in response to the Pi Mobile breach claim. The regulator also warned that stolen personal data is often abused by fraud syndicates.
PChome stated that its preliminary review found no intrusion affecting its main website or core systems. The company said the alleged incident remained under investigation.
The hacker group Settra claimed it had breached Pi Mobile Technology, a subsidiary of PChome Online, and stolen internal documents and user data. The claim was reported by Taiwan News and prompted scrutiny of the alleged incident.
A recent incident in Japan involved a web skimmer on an e-commerce site, with more than 100,000 records potentially affected. The malicious code was embedded into an existing JavaScript file on the website and was heavily obfuscated.
A Magecart-style web skimmer was found in a compromised webshop’s source code. The malicious JavaScript injected a fake payment form, captured payment data in real time, and exfiltrated it to gstatis.co at IP address 185.215.113.111 while using anti-debugging and persistence techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurity.macnica.co.jp
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Sansec uncovered a Magecart campaign that uses trusted **Google Tag Manager** and **Stripe** infrastructure to steal payment data from e-commerce checkout pages. The skimmer is delivered through a malicious but legitimate-looking GTM container and activates on **Magento** and **Adobe Commerce** checkout flows, where it harvests card numbers, expiration dates, CVV codes, names, billing addresses, email addresses, and phone numbers. The malware retrieves additional JavaScript from Stripe customer metadata and executes it dynamically, helping the attack blend into normal traffic to trusted services. The stolen data is obfuscated with **XOR**, stored locally, and later exfiltrated by creating fake customer records in an attacker-controlled Stripe account, causing the theft to appear as ordinary traffic to `api.stripe.com` and potentially bypass content security policies and network filtering. Sansec also identified a variant that uses **Google Firestore** instead of Stripe, pulling payloads from a document named `tracking/captcha` in a project called `braintree-payment-app`. Researchers said the Stripe customer record used to host the skimmer was created on Dec. 24, 2025, indicating the campaign may have been active since at least then.
Jun 29, 2026
Silent Push reported a large-scale **Magecart-style web-skimming** operation active since early 2022 that uses an extensive domain network to support client-side JavaScript skimmers on compromised e-commerce checkout pages. The activity is assessed to impact **online shoppers** and organizations that are **clients of major payment providers**, with targeting noted against **American Express, Diners Club, Discover, JCB, Mastercard, and UnionPay**; the skimmers are designed to quietly exfiltrate payment-card and other form data during transactions rather than disrupt systems. Technical reporting tied the infrastructure to domains hosting **highly obfuscated skimmer payloads** (e.g., `recorder.js`, `tab-gtm.js`) and described evasion logic that attempts to avoid execution when site administrators are present (e.g., checking the DOM for WordPress’ `wpadminbar`). The infrastructure analysis also linked parts of the campaign to a domain associated with the sanctioned bulletproof hosting ecosystem around **Stark Industries / PQ.Hosting**, which has been described as rebranding to *THE[.]Hosting* under **WorkTitans B.V.**, consistent with sanctions-evasion behavior; researchers emphasized that weak **third-party script governance** on payment pages remains a key enabling factor for this type of long-lived skimming operation.
Jun 29, 2026
A large Magecart campaign compromised nearly 100 Magento and Adobe Commerce stores by hiding a full credit-card skimmer inside a **1x1-pixel SVG** embedded directly in checkout page HTML. Researchers said the malware stores its payload in the SVG `onload` handler, decodes it with `atob()`, and runs it via `setTimeout`, allowing it to evade scanners that typically look for externally loaded scripts. When shoppers click checkout, the skimmer displays a convincing fake **"Secure Checkout"** overlay that captures billing and payment details before validating card numbers with the **Luhn algorithm**. The stolen data is exfiltrated as XOR-encrypted, base64-obfuscated JSON to attacker-controlled infrastructure, in some cases disguised as Facebook analytics traffic. Sansec linked the infections to exploitation of the **PolyShell** vulnerability, which affects Magento Open Source and Adobe Commerce stable version 2 deployments and can enable unauthenticated code execution and account takeover. Defenders were urged to hunt for hidden SVG tags and suspicious `onload` code, check for the `_mgx_cv` localStorage key, and block outbound traffic to the identified attacker infrastructure, including domains resolving to **`23.137.249.67`** hosted by IncogNet in the Netherlands.
Jun 29, 2026