FakeSecurity JS-Sniffer Stole Payment Cards From Magento Stores

Group-IB reported that the FakeSecurity JavaScript sniffer was used in a large Magecart-style campaign targeting Magento-based e-commerce sites, where malicious code was implanted into checkout pages to steal customers' payment card data. The activity was tied to attacker-controlled domains including alloaypparel.com and firstofbanks.com, along with compromised websites used to host payloads and lure pages.

Investigators linked the skimming operation to an earlier malware campaign aimed at likely e-commerce administrators, in which spam emails and fake document-viewer landing pages delivered the Vidar password stealer through the Mephistophilus phishing kit. Group-IB said the apparent goal was to harvest administrator credentials, gain access to Magento and other e-commerce CMS panels, and then deploy the skimmer; infrastructure overlap with earlier LokiBot and AZORult activity suggests the same cybercrime group ran multiple credential-theft operations to support the card-skimming attacks.