JS Sniffer: E-commerce Data Theft Made Easy
Summary: Volexity began tracking a financial data theft framework called JS Sniffer in late 2017, which injects JavaScript into compromised e-commerce checkout pages to capture names, addresses, credit card data, and login credentials, base64-encoding them into an HTTP GET request sent to an attacker-controlled server. Volexity found 70% of compromised sites analyzed ran Magento with many containing critical unpatched vulnerabilities, and the analyzed version 3.3 of the kit had Russian-language code comments and a README.txt.
What you should know: The kit ships with a dashboard counting stolen credit cards by source website, a generator for the malicious script, and a four-step setup with default admin:admin credentials - meaning the barrier to running this theft operation is a compromised Magento install and a few minutes of configuration.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026