wp-login.php injection silently exfiltrates a victim’s username and password back to the attacker’s server.

Another PHP web shell that promises it can bypass ‘server security’.

Analysis of the XBALTI phishing kits and their exfiltration techniques.

A variant of the PHP backtick minishell that obfuscates a PHP superglobal to evade detection.

lolzilla skimmer analyzes a visitor’s HTTP request to determine whether it can capture the visitor’s payment data using a PHP skimmer or if it should deploy a JavaScript skimmer onto the checkout page to capture the data.