Do Son New Magecart campaign mimics Stripe forms to skim credit cards. Malware hides from admins & tricks users with fake errors. Active since 2022.
Credit card skimming
Group-IB exposed an automated PhaaS kit that impersonates Aruba S.p.A. to steal credentials, credit card details, and OTPs. The multi-stage scam uses a CAPTCHA filter and Telegram for real-time exfiltration.
A rogue WordPress plugin is distributing multi-functional malware, performing credit card skimming, credential theft, ad fraud, and RCE through advanced evasion tactics.
Sucuri discovered a credit card skimming attack using a fake font domain to steal credit card data from a WordPress website.