Believe it or not - some people actually think hitmen advertise their services on the darknet…and the media plays into it.

wp-login.php injection silently exfiltrates a victim’s username and password back to the attacker’s server.

Another PHP web shell that promises it can bypass ‘server security’.

A JavaScript skimmer that loads from analiticsweb[.]site/analytics.js - and opsec failure leads to discovery of more malicious domains.

Analysis of the XBALTI phishing kits and their exfiltration techniques.