Severity: High | Priority: 1
This update adds signatures covering the infrastructure of a long-running web-skimming campaign. The campaign has compromised around 953 online stores since July 2025, most of them running Magento or Adobe Commerce. The attackers plant a small JavaScript loader inside the store’s CMS blocks, the static content sections Magento renders on every page. When a shopper visits an infected store, their browser silently contacts the attacker’s server. The server fingerprints the visitor to separate real shoppers from security scanners, and then decides whether to deliver a malicious payload. Earlier payloads in this campaign included a page posing as a well-known crypto hardware wallet brand.
The operator rotates to a new domain every few months. These signatures cover all nine known domains: the five loader domains used in turn since July 2025, two additional traffic-distribution domains, and two payload domains.