JS‑Sniffers 2 (G‑Analytics Family) – Underground Sale of Stolen Card Data

Group‑IB uncovered a new underground marketplace dedicated to selling stolen payment‑card data harvested by the JS‑Sniffers 2 threat actor, also known as the G‑Analytics family. The scripts inject malicious JavaScript into compromised web pages, capturing card details from users’ browsers before exfiltrating them to the attackers.

What happened

The JS‑Sniffers 2 family was identified by its use of obfuscated JavaScript that hooks into the document and window objects to intercept form submissions. Once card data is captured, it is posted to a command‑and‑control server that feeds an underground store where the data is sold to the highest bidder.

Impact

• Compromised merchants and e‑commerce sites that have not hardened their front‑end code.
• Customers whose card information is exposed to fraudsters.
• Potential regulatory penalties for non‑compliance with PCI‑DSS.

Detection & Mitigation

• Scan web assets for injected or obfuscated JavaScript using automated WAF rules or static analysis tools.
• Implement CSP (Content‑Security‑Policy) headers that restrict script sources to trusted origins.
• Use Web Application Firewalls to block known malicious payloads and monitor outbound traffic for unusual POST requests to external domains.
• Regularly audit third‑party scripts and remove any that are no longer required.

What to do now

Deploy a WAF with updated threat signatures, enforce strict CSP, and conduct a rapid audit of all front‑end code. Notify PCI‑DSS compliance officers if card data has been exposed, and coordinate with law enforcement to report the underground marketplace.