Loading story…
Multiple Japanese B2C e-commerce sites were compromised in a web skimming campaign that stole customers’ personal information, login credentials, and payment card data by injecting malicious JavaScript into checkout, login, and registration pages. Reporting from LAC linked the activity to techniques similar to Water Pamola, which Trend Micro and JPCERT/CC previously described as abusing malicious order submissions containing XSS payloads; when viewed in merchant administration panels, the payloads executed in administrators’ browsers, enabling credential theft, web shell deployment, and further compromise of the online store.
The campaign affected sites built on EC-CUBE as well as other platforms, indicating the attackers were targeting exploitable e-commerce implementations rather than a single product. The skimming code evolved over time, including increased obfuscation and infrastructure changes from googlevapis[.]com to jqueryapistatic[.]com, while some incidents used the victim’s own domain as an HTTPS exfiltration endpoint to reduce detection. Investigators said the attackers harvested cardholder names, card numbers, expiration dates, security codes, email addresses, and passwords, and recommended patching platforms and plugins, restricting administrator access, enabling MFA, deploying WAF protections, and reviewing logs for connections to known malicious domains.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By 2022-04-07, LAC reported multiple domestic Japanese B2C e-commerce sites had been compromised and modified with malicious JavaScript on checkout, login, and registration pages. The scripts stole personal and payment card data and exfiltrated it over HTTPS, sometimes to attacker-controlled endpoints hosted on other compromised e-commerce domains.
LAC observed that the attackers newly registered jqueryapistatic[.]com on 2021-11-07 and soon began using it in attacks. LAC assessed that updated malicious scripts were migrated from the previously used googlevapis[.]com infrastructure to this new domain.
On 2021-07-12, JPCERT/CC published follow-up reporting on the e-commerce attacks, including attacker infrastructure indicators and hashes tied to the campaign. The report emphasized that the attacks were not specific to EC-CUBE and could also succeed through vulnerable plugins.
JPCERT/CC stated the attack campaign was still ongoing as of 2021-07-01 and had confirmed similar cases affecting websites developed with EC-CUBE products. It described attackers stealing administrator credentials, deploying web shells and Adminer, and planting JavaScript to capture customer login and payment data.
On 2021-04-28, Trend Micro published research describing Water Pamola's use of malicious shopping orders with embedded XSS to compromise online shops. It also noted that at least one attacked site later disclosed a breach involving possible theft of names and payment card data.
Trend Micro said it had tracked Water Pamola activity since 2019, in which attackers targeted e-commerce sites by submitting orders containing XSS payloads that executed in merchant administration panels. The campaign used follow-on payloads for actions including page grabbing, credential phishing, web shell deployment, and malware delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
lac.co.jp
Open sourceblogs.jpcert.or.jp
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Researchers reported widespread **web skimmer** activity targeting e-commerce sites, where attackers injected malicious JavaScript into checkout pages to steal payment-card data and send it to attacker-controlled command-and-control infrastructure. Analysis of **351,972 compromised HTML pages** across **6,684 unique domains** found the activity was globally distributed, with the highest concentration of affected domains in the **United States**. The investigation identified **10,764 unique malicious JavaScript snippets** grouped into **63 malware families**, with a small number of families driving most of the observed activity. A closer look at one representative cluster, **`family7`**, showed heavy code variation, obfuscation, and frequent infrastructure changes, including domains such as `informaer[.]net`, `cloudservice[.]tw`, and `onlinestatus[.]site`, underscoring how polymorphic skimmer campaigns evade static detection and persist on poorly maintained web platforms.
Aug 15, 2026
Researchers linked a broader **Magecart 12** web-skimming operation to the domain `jquerycdn.su`, identifying dozens of compromised online stores where malicious JavaScript was injected to steal shoppers’ payment data. The campaign was observed from at least late 2019 into early 2020, and investigators said many affected sites were still infected even after the skimmer infrastructure temporarily went offline. Any payment information entered on impacted checkout pages during the exposure window was assessed as potentially compromised. Analysis of the malware showed the skimmer evolved through at least four iterations while keeping a consistent obfuscation style associated with earlier Magecart 12 activity. Earlier variants used a first-stage payload padded with garbage code, while newer versions expanded collection beyond standard payment forms to harvest **all fields on a page**, increasing the amount of customer data that could be captured. Researchers also tied the exfiltration infrastructure to other Magecart 12 campaigns, indicating a sustained and adaptable card-theft operation targeting e-commerce platforms.
Aug 15, 2026