Top Alexa Sites Infected With Malicious Coinminers and Web Skimmer
Summary: Unit 42's threat hunting campaign across the top 10,000 Alexa-ranked websites found four affected sites serving malicious coinminers, malicious external links, and a web skimmer. More than 60 URL pages on pojoksatu[.]id and zoombangla[.]com were injected with Coinhive mining scripts, and a skimmer on a store linked from heureka[.]cz ran every 99 seconds to capture payment card input and send it to the collection server metahtmlhead[.]com.
Key Takeaway: The skimmer validated stolen card numbers with the Luhn Algorithm and exfiltrated card number and address data to an attacker server, and Unit 42 observed visits to the affected sites from Western Europe, the Eastern U.S., and the Western U.S. - a broad pool of potential victims reached through links on sites users already trust.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026