Loading story…
Group-IB reported that the FakeSecurity JavaScript sniffer was used in a large Magecart-style campaign targeting Magento-based e-commerce sites, where malicious code was implanted into checkout pages to steal customers' payment card data. The activity was tied to attacker-controlled domains including alloaypparel.com and firstofbanks.com, along with compromised websites used to host payloads and lure pages.
Investigators linked the skimming operation to an earlier malware campaign aimed at likely e-commerce administrators, in which spam emails and fake document-viewer landing pages delivered the Vidar password stealer through the Mephistophilus phishing kit. Group-IB said the apparent goal was to harvest administrator credentials, gain access to Magento and other e-commerce CMS panels, and then deploy the skimmer; infrastructure overlap with earlier LokiBot and AZORult activity suggests the same cybercrime group ran multiple credential-theft operations to support the card-skimming attacks.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Analysis of domains tied to FakeSecurity showed they were also used in a malware distribution campaign beginning in March 2019. The campaign used spam emails and fake document-viewer landing pages to deliver malware to likely e-commerce administrators.
Group-IB found that the same server infrastructure had previously hosted phishing infrastructure and admin panels for LokiBot and AZORult, linking the operation to malware spam activity in January 2019. This suggested the same cybercrime group may have conducted multiple credential-theft campaigns.
Group-IB reported that the FakeSecurity JavaScript sniffer family was detected in December 2018. The skimmer targeted Magento-based e-commerce sites and stole payment card data during checkout.
Later FakeSecurity activity used fiswedbesign.com and alloaypparel.com to store JS-sniffer source code. Group-IB also noted these domains, along with firstofbanks.com, were registered with the email address greenstreethunter@india.com.
Group-IB determined the attackers used the Mephistophilus phishing kit to build fake PDF-viewer pages that prompted victims to download malicious EXE files. The delivered malware was Vidar password stealer, intended to harvest credentials and enable access to e-commerce admin panels for JS-sniffer deployment.
In early attacks, the FakeSecurity operators used the domain magento-security[.]org as a gate for stolen credentials and to store sniffer source code. This reflects the campaign's initial infrastructure for exfiltration and payload hosting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers found a compromised **X-Cart** e-commerce site running two separate payment skimmers: a basic server-side stealer and a more advanced client-side JavaScript skimmer. The server-side malware captured base64-encoded payment `POST` data and saved it to a fake `.jpg` file, while the browser-based skimmer validated that a credit card number was present before exfiltrating checkout data to attacker infrastructure. Analysts traced the X-Cart exfiltration path to `metahtmlhead[.]com/folder/ip/zxc.php`, with the destination assembled through DOM-based domain construction to hinder detection. The JavaScript skimmer used layered obfuscation and an anti-debugging technique tied to wrapper-function length, forcing researchers to brute-force parts of the code to recover its behavior. A similar skimmer was later identified on a **Magento 1.x** site, using the same obfuscation style and a matching URL path structure but sending stolen payment data to `winsiott[.]com/folder/ip/stt.php`. The overlap in code design, evasion methods, and infrastructure indicates a broader web-skimming campaign targeting multiple e-commerce platforms.
Aug 15, 2026
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Researchers linked a broader **Magecart 12** web-skimming operation to the domain `jquerycdn.su`, identifying dozens of compromised online stores where malicious JavaScript was injected to steal shoppers’ payment data. The campaign was observed from at least late 2019 into early 2020, and investigators said many affected sites were still infected even after the skimmer infrastructure temporarily went offline. Any payment information entered on impacted checkout pages during the exposure window was assessed as potentially compromised. Analysis of the malware showed the skimmer evolved through at least four iterations while keeping a consistent obfuscation style associated with earlier Magecart 12 activity. Earlier variants used a first-stage payload padded with garbage code, while newer versions expanded collection beyond standard payment forms to harvest **all fields on a page**, increasing the amount of customer data that could be captured. Researchers also tied the exfiltration infrastructure to other Magecart 12 campaigns, indicating a sustained and adaptable card-theft operation targeting e-commerce platforms.
Aug 15, 2026