Loading story…
Researchers reported widespread web skimmer activity targeting e-commerce sites, where attackers injected malicious JavaScript into checkout pages to steal payment-card data and send it to attacker-controlled command-and-control infrastructure. Analysis of 351,972 compromised HTML pages across 6,684 unique domains found the activity was globally distributed, with the highest concentration of affected domains in the United States.
The investigation identified 10,764 unique malicious JavaScript snippets grouped into 63 malware families, with a small number of families driving most of the observed activity. A closer look at one representative cluster, family7, showed heavy code variation, obfuscation, and frequent infrastructure changes, including domains such as informaer[.]net, cloudservice[.]tw, and onlinestatus[.]site, underscoring how polymorphic skimmer campaigns evade static detection and persist on poorly maintained web platforms.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Between May and September 2020, the researchers detected an average of 65,000 malicious HTML pages and 24,000 unique compromised URLs per month. The findings highlighted sustained, large-scale formjacking activity targeting compromised websites, especially e-commerce sites.
Unit 42 analyzed 351,972 compromised HTML pages across 6,684 unique domains between October 2019 and October 2020, showing broad global web skimmer activity with the largest concentration in the United States. The researchers extracted 10,764 malicious JavaScript snippets and grouped them into 63 malware families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Multiple Japanese B2C e-commerce sites were compromised in a web skimming campaign that stole customers’ personal information, login credentials, and payment card data by injecting malicious JavaScript into checkout, login, and registration pages. Reporting from LAC linked the activity to techniques similar to **Water Pamola**, which Trend Micro and JPCERT/CC previously described as abusing malicious order submissions containing XSS payloads; when viewed in merchant administration panels, the payloads executed in administrators’ browsers, enabling credential theft, web shell deployment, and further compromise of the online store. The campaign affected sites built on **EC-CUBE** as well as other platforms, indicating the attackers were targeting exploitable e-commerce implementations rather than a single product. The skimming code evolved over time, including increased obfuscation and infrastructure changes from `googlevapis[.]com` to `jqueryapistatic[.]com`, while some incidents used the victim’s own domain as an HTTPS exfiltration endpoint to reduce detection. Investigators said the attackers harvested cardholder names, card numbers, expiration dates, security codes, email addresses, and passwords, and recommended patching platforms and plugins, restricting administrator access, enabling MFA, deploying WAF protections, and reviewing logs for connections to known malicious domains.
Aug 15, 2026
Researchers linked a broader **Magecart 12** web-skimming operation to the domain `jquerycdn.su`, identifying dozens of compromised online stores where malicious JavaScript was injected to steal shoppers’ payment data. The campaign was observed from at least late 2019 into early 2020, and investigators said many affected sites were still infected even after the skimmer infrastructure temporarily went offline. Any payment information entered on impacted checkout pages during the exposure window was assessed as potentially compromised. Analysis of the malware showed the skimmer evolved through at least four iterations while keeping a consistent obfuscation style associated with earlier Magecart 12 activity. Earlier variants used a first-stage payload padded with garbage code, while newer versions expanded collection beyond standard payment forms to harvest **all fields on a page**, increasing the amount of customer data that could be captured. Researchers also tied the exfiltration infrastructure to other Magecart 12 campaigns, indicating a sustained and adaptable card-theft operation targeting e-commerce platforms.
Aug 15, 2026