Scanner-Evading Skimming Code Found on Nearly 1,000 Online Stores

Infosecurity Magazine reports that attackers have infected 953 online stores with a JavaScript loader designed specifically to evade automated security scanners, in a campaign that has been active since July 2025. The malicious code functions as a payment skimmer, capturing card data and sensitive customer information entered at checkout before passing it to attacker-controlled infrastructure. The loader's architecture is built around detection avoidance, meaning that the scanning tools many e-commerce operators use as their primary security check may not identify the presence of the code. The campaign's duration and scale suggest a well-resourced and methodical operation.

Why this matters for UK organisations

Skimming attacks on e-commerce platforms have been a persistent threat for several years, but the use of a loader specifically engineered to bypass standard scanners raises the detection challenge considerably. Many UK retailers, particularly smaller and mid-sized operators, rely on automated scanning as their main mechanism for identifying malicious code on their checkout pages. A loader that evades those tools can remain in place for months, silently harvesting customer payment data throughout that period. Beyond the direct harm to customers, the regulatory implications for UK businesses are significant: a payment data breach triggers obligations under both UK GDPR and PCI DSS, and the reputational consequences of a prolonged, undetected skimming infection can be severe. Organisations that process card payments online should treat this campaign as a prompt to reassess whether their current detection approach is sufficient.

What to review

UK e-commerce operators should review the tools currently used to monitor their checkout pages and assess whether those tools are capable of detecting obfuscated or loader-based skimming code. Where automated scanning is the primary control, consider supplementing it with manual code review or specialist web application security testing. Implementing subresource integrity checks on third-party scripts loaded at checkout, auditing the list of external scripts your payment pages depend on, and ensuring your e-commerce platform and any plugins are kept up to date are all practical steps. If your organisation processes card payments online and has not had a qualified security assessment of your checkout flow recently, this is a reasonable moment to schedule one.

Source: Infosecurity Magazine