A New Web Skimmer Campaign Targets Real Estate Websites Through Attacking Cloud Video Distribution Supply Chain
Summary: Unit 42 detected a web skimmer campaign that compromised over 100 real estate websites, all belonging to one parent company, by injecting malicious JavaScript into a video hosted on a cloud video platform that every site imported. The skimmer reads names, emails, phone numbers and credit card data from HTML forms and sends them to a collection server at cdn-imgcloud[.]com/img, using obfuscated code with anti-debugging checks for the Chrome console.
What's compelling: A single tampered JavaScript file on a shared cloud video platform reached more than 100 sites without any of those organizations knowing, and Unit 42 notes that blocking skimmer domain names or URLs is ineffective against code this polymorphic.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026