Loading story…
Group-IB reported that the UltraRank threat group resumed web-skimming attacks against eCommerce websites, using a SnifLite JavaScript sniffer to steal payment card data from online shoppers. Investigators identified 12 compromised stores in the observed wave, with eight still infected at the time of publication, and said the attackers likely gained access through stolen CMS administrator credentials or brute-force attacks. The malicious script was Radix-obfuscated and delivered from the spoofed domain googletagsmanager[.]co, which impersonated Google Tag Manager while also acting as a collection point for exfiltrated card data.
Infrastructure analysis tied the campaign to a backend server at 45.141.84[.]239, associated with Media Land LLC, and to s-panel[.]su, which was likely used as a control panel for managing stolen payment data. Group-IB said the activity fits UltraRank’s broader history of compromising hundreds of online stores and service providers in long-running payment-card theft operations, underscoring the continued risk that client-side JavaScript skimmers pose to retailers and their customers.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Group-IB experts discovered a new wave of UltraRank attacks in November 2020 targeting eCommerce websites. The campaign used a Radix-obfuscated JavaScript sniffer from the SnifLite family.
In August 2020, Group-IB published a report titled “UltraRank: the unexpected twist of a JS-sniffer triple threat.” The report said UltraRank had attacked 691 eCommerce stores and 13 website service providers over five years.
Group-IB said UltraRank has used the SnifLite JavaScript sniffer family since at least January 2019, including an attack on the Adverline advertising network. This establishes the earlier use of the malware family later seen in the renewed campaign.
Group-IB found an unobfuscated sniffer sample matching one previously seen on UltraRank infrastructure and tied the operation to googletagsmanager[.]co, backend server 45.141.84[.]239, and s-panel[.]su. The researchers assessed s-panel[.]su was likely a control panel used to collect and manage stolen payment card data.
During the newly discovered campaign, Group-IB Threat Intelligence identified 12 infected online stores and found that eight were still infected at the time of publication. Group-IB also sent notifications to the affected websites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that a JavaScript payment-card skimmer dubbed **E1RB** was deployed on compromised e-commerce sites, where it used modified Google Analytics-like injectors to load obfuscated malicious code only on checkout-related pages. The malware replaced legitimate payment forms with fake ones, captured customers’ card details, and exfiltrated the stolen data to attacker-controlled domains, allowing the activity to blend into normal storefront behavior while targeting the point of payment. The analyzed samples showed multiple anti-detection features, including unique hashes generated for each request, randomized variable and function names, and in one case time-based obfuscation tied to the minute of the request. Group-IB assessed **E1RB** as a modified variant of the **Grelos** JavaScript sniffer family and linked six malicious domains—including `google-analitics[.]org` and `cdn-gstat[.]com`—to operator-associated email addresses, with additional infrastructure suggesting possible preparation for attacks against **Telr**-based online stores via `telrshop[.]com`.
Aug 15, 2026
Researchers reported widespread **web skimmer** activity targeting e-commerce sites, where attackers injected malicious JavaScript into checkout pages to steal payment-card data and send it to attacker-controlled command-and-control infrastructure. Analysis of **351,972 compromised HTML pages** across **6,684 unique domains** found the activity was globally distributed, with the highest concentration of affected domains in the **United States**. The investigation identified **10,764 unique malicious JavaScript snippets** grouped into **63 malware families**, with a small number of families driving most of the observed activity. A closer look at one representative cluster, **`family7`**, showed heavy code variation, obfuscation, and frequent infrastructure changes, including domains such as `informaer[.]net`, `cloudservice[.]tw`, and `onlinestatus[.]site`, underscoring how polymorphic skimmer campaigns evade static detection and persist on poorly maintained web platforms.
Aug 15, 2026
Multiple Japanese B2C e-commerce sites were compromised in a web skimming campaign that stole customers’ personal information, login credentials, and payment card data by injecting malicious JavaScript into checkout, login, and registration pages. Reporting from LAC linked the activity to techniques similar to **Water Pamola**, which Trend Micro and JPCERT/CC previously described as abusing malicious order submissions containing XSS payloads; when viewed in merchant administration panels, the payloads executed in administrators’ browsers, enabling credential theft, web shell deployment, and further compromise of the online store. The campaign affected sites built on **EC-CUBE** as well as other platforms, indicating the attackers were targeting exploitable e-commerce implementations rather than a single product. The skimming code evolved over time, including increased obfuscation and infrastructure changes from `googlevapis[.]com` to `jqueryapistatic[.]com`, while some incidents used the victim’s own domain as an HTTPS exfiltration endpoint to reduce detection. Investigators said the attackers harvested cardholder names, card numbers, expiration dates, security codes, email addresses, and passwords, and recommended patching platforms and plugins, restricting administrator access, enabling MFA, deploying WAF protections, and reviewing logs for connections to known malicious domains.
Aug 15, 2026