FakeClicky Activity: Skimmers Hit Again

Zscaler ThreatLabz describes the FakeClicky skimmer campaign that injects a fake Google Analytics loader into e-commerce sites to load obfuscated JavaScript on checkout pages and exfiltrate payment details; the campaign leverages newly registered lookalike domains (many resolving to 195.54.160.61 and 195.54.160.161), various evasion techniques, and includes variants that replace legitimate payment forms (including Braintree). The report provides the skimmer flow, sample payload behavior, a list of related domains and IP indicators of compromise, and high-level recommendations for shoppers.