Massive malicious campaign by FakeSecurity JS-sniffer

Group-IB identified the FakeSecurity JS-sniffer campaign (Dec 2018–2019) where attackers used Mephistophilus phishing landing pages and spam to deliver Vidar password-stealer to e-commerce administrators, then leveraged stolen credentials to install JS-sniffers on Magento sites to capture customers' payment data; the report details the infection chain, associated infrastructure (domains, IPs), and file hashes for detection and remediation.