Web Skimming Campaigns Steal Payment Data From E-Commerce Checkouts

Researchers detailed a Magecart-style web skimmer planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used anti-debugging, adaptive field mapping, and localStorage persistence to evade detection and maintain access, with reported indicators including gstatis.co and 185.215.113.111.

Separate reporting on a major Japanese case described a similar web skimming intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than 100,000 records. Analysts said Content Security Policy (CSP) would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to www.javascriptworld.xyz/isSafe.php, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.