Loading story…
Group-IB reported that a JavaScript payment-card skimmer dubbed E1RB was deployed on compromised e-commerce sites, where it used modified Google Analytics-like injectors to load obfuscated malicious code only on checkout-related pages. The malware replaced legitimate payment forms with fake ones, captured customers’ card details, and exfiltrated the stolen data to attacker-controlled domains, allowing the activity to blend into normal storefront behavior while targeting the point of payment.
The analyzed samples showed multiple anti-detection features, including unique hashes generated for each request, randomized variable and function names, and in one case time-based obfuscation tied to the minute of the request. Group-IB assessed E1RB as a modified variant of the Grelos JavaScript sniffer family and linked six malicious domains—including google-analitics[.]org and cdn-gstat[.]com—to operator-associated email addresses, with additional infrastructure suggesting possible preparation for attacks against Telr-based online stores via telrshop[.]com.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
In January 2021, Group-IB analysts identified a new JavaScript payment-card skimmer family on compromised e-commerce sites and named it E1RB. The malware used modified Google Analytics-like injectors to load obfuscated payloads on checkout-related pages.
Based on its infrastructure analysis, Group-IB assessed that telrshop[.]com may have been prepared for attacks against websites built on the Telr platform. This suggested potential expansion of E1RB activity toward Telr-based stores.
Group-IB linked six domains used to host malicious files and collect stolen payment data to email addresses associated with the operators, including alexey_rublev@protonmail.ru and alexey_rublev@protonmail.com. The linked domains included google-analitics[.]org, cdn-gstat[.]com, jquery-live[.]com, jquery-on[.]com, cdn-host[.]org, and telrshop[.]com.
Group-IB found two similar E1RB samples on infected websites, both of which generated unique malicious scripts per request, replaced legitimate payment forms with fake ones, and exfiltrated stolen card data. The company assessed both samples as modified variants of the Grelos JavaScript sniffer family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported widespread **web skimmer** activity targeting e-commerce sites, where attackers injected malicious JavaScript into checkout pages to steal payment-card data and send it to attacker-controlled command-and-control infrastructure. Analysis of **351,972 compromised HTML pages** across **6,684 unique domains** found the activity was globally distributed, with the highest concentration of affected domains in the **United States**. The investigation identified **10,764 unique malicious JavaScript snippets** grouped into **63 malware families**, with a small number of families driving most of the observed activity. A closer look at one representative cluster, **`family7`**, showed heavy code variation, obfuscation, and frequent infrastructure changes, including domains such as `informaer[.]net`, `cloudservice[.]tw`, and `onlinestatus[.]site`, underscoring how polymorphic skimmer campaigns evade static detection and persist on poorly maintained web platforms.
Aug 15, 2026
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Group-IB reported that the **FakeSecurity** JavaScript sniffer was used in a large Magecart-style campaign targeting Magento-based e-commerce sites, where malicious code was implanted into checkout pages to steal customers' payment card data. The activity was tied to attacker-controlled domains including `alloaypparel.com` and `firstofbanks.com`, along with compromised websites used to host payloads and lure pages. Investigators linked the skimming operation to an earlier malware campaign aimed at likely e-commerce administrators, in which spam emails and fake document-viewer landing pages delivered the **Vidar** password stealer through the **Mephistophilus** phishing kit. Group-IB said the apparent goal was to harvest administrator credentials, gain access to Magento and other e-commerce CMS panels, and then deploy the skimmer; infrastructure overlap with earlier **LokiBot** and **AZORult** activity suggests the same cybercrime group ran multiple credential-theft operations to support the card-skimming attacks.
Aug 14, 2026