Analysis Summary

Cybersecurity researchers have uncovered a sophisticated credit card skimmer campaign targeting WordPress e-commerce checkout pages by injecting malicious JavaScript into the CMS’s database table (wp_options).

According to the researcher, malware leverages the "widget_block" option to embed harmful code through the WordPress admin panel enabling it to evade detection. It activates exclusively on checkout pages either by manipulating existing payment fields or generating fake ones to steal sensitive payment details such as credit card numbers, CVV, and billing information.

The malicious JavaScript identifies checkout pages and dynamically generates counterfeit payment screens mimicking trusted processors like Stripe. It can also intercept user data entered into legitimate payment forms.

Captured data is encrypted using Base64 and AES-CBC to avoid analysis before being transmitted to attacker-controlled servers like "valhafather[.]xyz" and "fqbe23[.]xyz." A similar campaign highlighted by a researcher involved a three-layer obfuscation technique with stolen data encoded as JSON, XOR-encrypted, and Base64-encoded before exfiltration to domains such as "staticfonts[.]com."

This threat is part of a broader wave of financially motivated cyberattacks. Another recent campaign involved phishing emails disguised as PayPal payment requests. Exploiting legitimate PayPal URLs and originating from authentic addresses, attackers manipulated Microsoft 365 test domains to bypass security measures. Victims inadvertently linked their PayPal accounts to the attacker’s email, granting unauthorized access.

Additionally, threat actors have adopted a novel "transaction simulation spoofing" technique to exploit Web3 wallets.

By exploiting the time delay between transaction simulation and execution, attackers set up fake decentralized app (DApp) sites to drain victim wallets. This method, which capitalizes on user trust in wallet features, represents an advanced and hard-to-detect phishing evolution, posing a severe challenge to cybersecurity defenses.