Threat Intel
UltraRank JavaScript Sniffer Infects 12 eCommerce Sites – Immediate Mitigation Steps
UltraRank’s latest campaign deployed a JavaScript‑sniffer to compromise 12 eCommerce websites. The malware harvests user data and injects malicious scripts, threatening customer privacy and site integrity. Defenders should scan for the sniffer payload, block its delivery, and patch any exposed endpoints.
What happened
UltraRank used a JavaScript‑sniffer to infiltrate 12 eCommerce platforms, injecting malicious code that can exfiltrate data and serve additional payloads.
Impact
Infected sites risk data theft, session hijacking, and brand damage. Customers may unknowingly interact with compromised scripts.
What to do
- Run a full static and dynamic scan for the sniffer signature in front‑end assets.
- Block the delivery of the malicious script via web‑application firewall or CDN rules.
- Check for back‑door endpoints and remove any unauthorized scripts.
- Notify affected customers and provide remediation guidance.
- Update any third‑party libraries that may be vulnerable to injection.
Detection Tips
Look for unexpected tags referencing external domains or obfuscated code patterns typical of UltraRank sniffer.
Related articles
PhantomRaven: Bug‑Bounty Hunter Turns AI‑Generated Stealer Into Profit Machine
A financially motivated threat actor, posing as a bug‑bounty hunter, has crafted and distributed the JavaScript‑based information stealer PhantomRaven. Leveraging large‑language‑model code generation, the tool harvests credentials, session tokens and other sensitive data from compromised web pages. CrowdStrike’s analysis reveals the actor’s distribution tactics, the malware’s persistence mechanisms, and actionable detection and mitigation steps for defenders.
Read briefing
FakeSecurity JS‑Sniffer Campaign Targets Web Applications – Immediate Mitigation Steps
Group‑IB uncovered a new JavaScript sniffer, FakeSecurity, that injects malicious scripts into web pages to harvest credentials and session data. The campaign has affected multiple enterprise web applications, exploiting cross‑site scripting and insecure content delivery. Defenders should block known malicious domains, update WAF rules, and monitor for suspicious JavaScript payloads.
Read briefing
AI-Analysis Evasion in Malware: 84 Samples, 35% Success, 2025‑2026
Malware authors are embedding natural‑language instructions to mislead AI‑based analysis tools. Cisco Talos identified 84 samples across four families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) from Jan 2025 to Jul 2026, with a 35% success rate in evading detection. Defenders should treat any extracted plaintext as evidence, not instructions, and update triage pipelines accordingly.
Read briefing
BigDiskBuster PoC Blocks Windows Defender Updates While Service Runs
A proof‑of‑concept called BigDiskBuster can stop Windows Defender from downloading update packages without exploiting a vulnerability, leaving the service running but blind to new signatures. The technique was demonstrated by LevelBlue after the original PoC was removed from GitHub. Defenders should verify update status, enforce update policies, and consider alternative EDR solutions.
Read briefing