A twist on the old ‘analytics code’ camouflage used by some skimmers to evade detection.

A JavaScript skimmer that loads from analiticsweb[.]site/analytics.js - and opsec failure leads to discovery of more malicious domains.

lolzilla skimmer analyzes a visitor’s HTTP request to determine whether it can capture the visitor’s payment data using a PHP skimmer or if it should deploy a JavaScript skimmer onto the checkout page to capture the data.

A PHP skimmer that exfiltrates the stolen payment data to a fake DLL file on the malicious domain secure-authorize.net.

_try_action is a JavaScript skimmer and exfiltrates the stolen payment data to fake PNG image file at cdn-frontend.com/stat/pix.png