LIVE_FEED
--:--:--[HIGH]shop-***-deals.com→Magecart skimmer (Group 7)// US-EAST--:--:--[HIGH]wp-***-blog.net→Drive-by iframe → exploit kit// EU-WEST--:--:--[MEDIUM]cdn-***-helper.io→Obfuscated cryptominer (CoinIMP)// AP-SOUTH--:--:--[HIGH]auth-***-login.co→Credential phishing kit (16shop)// EU-CENTRAL--:--:--[MEDIUM]media-***-files.org→Malicious redirect chain → ClickFix// US-WEST--:--:--[HIGH]support-***-desk.com→FakeUpdates / SocGholish payload// US-EAST--:--:--[LOW]track-***-pixel.app→Unauthorized 3rd-party tracker// EU-NORTH--:--:--[MEDIUM]img-***-host.ru→Drive-by download (TLD reputation)// EU-EAST--:--:--[HIGH]api-***-stats.xyz→C2 beacon (Cobalt Strike profile)// AP-EAST--:--:--[LOW]promo-***-coupon.shop→Affiliate cloaking + cookie stuff// US-CENTRAL--:--:--[HIGH]shop-***-deals.com→Magecart skimmer (Group 7)// US-EAST--:--:--[HIGH]wp-***-blog.net→Drive-by iframe → exploit kit// EU-WEST--:--:--[MEDIUM]cdn-***-helper.io→Obfuscated cryptominer (CoinIMP)// AP-SOUTH--:--:--[HIGH]auth-***-login.co→Credential phishing kit (16shop)// EU-CENTRAL--:--:--[MEDIUM]media-***-files.org→Malicious redirect chain → ClickFix// US-WEST--:--:--[HIGH]support-***-desk.com→FakeUpdates / SocGholish payload// US-EAST--:--:--[LOW]track-***-pixel.app→Unauthorized 3rd-party tracker// EU-NORTH--:--:--[MEDIUM]img-***-host.ru→Drive-by download (TLD reputation)// EU-EAST--:--:--[HIGH]api-***-stats.xyz→C2 beacon (Cobalt Strike profile)// AP-EAST--:--:--[LOW]promo-***-coupon.shop→Affiliate cloaking + cookie stuff// US-CENTRAL
threat glossary

Web Skimmer

A client-side script that steals payment-card data or credentials from forms, typically exfiltrating them to an attacker-controlled domain.

What it is

A web skimmer is JavaScript that monitors form inputs (checkout, login, signup) and forwards their values to a remote attacker-controlled endpoint. Modern skimmers obfuscate with multi-layer eval chains, store stolen data in service workers, or hide payloads in PNG/SVG steganography. They are the dominant client-side threat against e-commerce in 2024–2026.

Real-world examples

  • Inter skimmer kit
  • M-Skim variants targeting Magento
  • Skimmers hosted via Google Tag Manager (2023–2024)

How ExploitShield detects it

Every JS body executed against a monitored page is captured at MITM-proxy level, deobfuscated through several layers of common packers, and fingerprinted for skimmer patterns. Matching evidence is included verbatim in every alert.

Related terms

MagecartFormjacking