JS Sniffer: E-commerce Data Theft Made Easy

Volexity analyzes JS Sniffer, a JavaScript skimmer framework (version 3.3) used since 2017 to steal customer PII and payment-card data from compromised e-commerce sites—especially Magento—by injecting or loading malicious JS (often disguised as analytics) that captures form fields, encodes them in base64, and exfiltrates them via HTTP(S) GET requests to attacker-controlled servers. The report includes example captured data, admin panel and database details, regex parsing rules, IOCs (domains and IPs), and Suricata/Snort signatures, and recommends patching vulnerable e-commerce platforms and searching web logs for the provided indicators.