JavaScript sniffers’ new tricks

In January 2021 Group-IB identified and unpacked the E1RB JavaScript sniffer family (a Grelos variant) that infects e-commerce sites by replacing checkout payment forms with Base64-encoded fakes and capturing card data; attackers deploy the sniffer via modified Google Analytics-like injectors, use server-side per-request obfuscation (including time-based deobfuscation and randomized variable/function names) to evade detection, and exfiltrate data to lookalike domains (e.g., google-analitics.org, cdn-gstat.com), with the report providing technical deobfuscation, IOCs/infrastructure linkage, and mitigation recommendations for banks, merchants, and payment processors.