A unique phishing kit that targets McDonald's customers in Saudi Arabia and has a convincing mobile/desktop responsiveness.

JavaScript code in the file /media/js/js-color.min.js on an infected Magento website loads a skimmer and then exfiltrates the stolen data to the malicious domain united81.com.

A JavaScript injection found on a compromised Magento website loads a skimmer from jsdelivr.at and then exfiltrates the stolen data back.

A JavaScript injection in the Magento database table core_config_data loads a skimmer and then exfiltrates the stolen data to the malicious domain cdn-fonts.com.

A JavaScript based skimmer loaded from an injection in the website’s Magento database table cms_block.