Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages

Cybersecurity researchers have uncovered a major web skimming campaign that has been active since January 2022, targeting major payment networks including American Express, Diners Club, Discover, JCB Co., Mastercard and UnionPay. The campaign uses highly obfuscated JavaScript loaded from the domain cdn-cookie[.]com to harvest credit card details and other personal data on checkout pages, a technique described as Magecart.

It includes anti-detection measures, such as checking for a WordPress wpadminbar element and, if detected, removing itself; it also monitors if Stripe is the selected payment option and can render a fake Stripe form in place of the real one unless a wc_cart_hash flag in localStorage is set to true. The stolen data—names, phone numbers, email addresses and shipping details—are exfiltrated via an HTTP POST to lasorie[.]com, after which the skimmer erases traces from the page and restores the legitimate Stripe form.

According to Silent Push, the attackers demonstrate advanced knowledge of WordPress and integrate lesser-known features into their attack chain. This campaign, part of the Magecart umbrella, shows how criminals continue to evolve web skimming to target enterprise clients of major payment providers.