PHP -> JavaScript Conversion - $dataoo Skimmer
A comparison of a skimmer that an attacker rolled out in separate PHP and JavaScript versions. Big thanks to Baryo (@ctrl__esc)!
Backticks + $_POST = PHP minishell
The use of the lesser known backtick operator and $_POST results in probably one of the smallest PHP one-liner minishells: ~12 characters
PaaS à la carte: Phishing Kit Caught In Development
A phishing kit found in-the-wild during the development stage and leaks the ‘order notes’ from the buyer.
Magento PHP Skimmer - new validateData variant
A variant of the
validateData skimmer. This skimmer is saving payment data to a secondary file after the skimmer is injected into the Magento core file OnepageController.php.
Magento PHP Skimmer - validateData
A PHP skimmer stealing payment data and user login data is injected into Magento core files OnepageController.php and User.php.