Trends in Web Threats: Old Web Skimmer Still Active Today
Summary: Palo Alto Networks' Advanced URL Filtering detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022, with most apparent domain origins in the United States, Germany and Russia. The most notable finding was a web skimmer active for five years that checks for 'onepage' or 'checkout' in the URL, harvests payment-page inputs and sends them to cloudfusion[.]me, appearing across 27,917 URLs on 14 websites.
What's compelling: A skimmer first reported in 2017 is still collecting payment data in 2022 across 14 websites and nearly 28,000 URLs, so an old, lightly obfuscated script posing as jquery.min.js remains a live risk to checkout pages.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026