Casio UK online store hacked to steal customer credit cards

Casio UK's online store was compromised between 14–24 January 2025 by a two-stage web skimmer that injected a fake checkout form to capture billing and full payment card data; the skimmer fetched a second-stage payload from a Russian host, used obfuscation and XOR-based string concealment, encrypted stolen records with AES-256-CBC, and exfiltrated them to an attacker-controlled IP. JSCrambler discovered the compromise and Casio removed the malicious script within 24 hours; the attack exploited Magento vulnerabilities and a permissive Content Security Policy, and reportedly targeted 17 additional sites.