Lazarus BTC Changer

Group-IB analyzed a Lazarus campaign dubbed “BTC Changer” in which attackers modified JavaScript skimmers previously used for card theft to instead swap merchants' BTC/ETH payment addresses (and deploy fake payment forms) on compromised e-commerce sites, extracting ~0.8999 BTC and ~4.3847 ETH to attacker-controlled wallets; the report includes compromised site names, sample snippets, wallet addresses, and transaction links to CoinPayments.net.