Meet the JS-Sniffers 3: Illum Family

Group-IB analyzed the Illum family of JavaScript sniffers that target e-commerce sites (notably Magento) to inject fake payment forms, capture customers’ payment credentials, and exfiltrate stolen data to attacker-controlled gates; the report documents exploited vulnerabilities (including CVE-2016-4010 and plugin RCE), attacker infrastructure (malicious scripts, gates, SSL usage), and multiple JS-sniffer samples and fake payment forms used in the campaign.