A JavaScript injection in the Magento database table core_config_data loads a skimmer and then exfiltrates the stolen data to the malicious domain cdn-fonts.com.

A JavaScript based skimmer loaded from an injection in the website’s Magento database table cms_block.

Attackers continue to find easy victims by crawling websites using enumeration techniques and looking for configuration files that have had their file extension modified.

Variants of popular PHP web shells have been popping up and analysis reveals that they contain a hidden backdoor used to steal the unauthorized access.

There’s a good chance that Anonymous Fox has scanned your website for different vulnerabilities at least once during the last 12-16 months. The majority of hacked WordPress websites I’ve encountered over the last 14 months have evidence of Anonymous Fox activity. How do they do it?