Grelos Skimmer

The Grelos Skimmer, a relatively old credit card skimmer, appears to be gaining popularity among cybercriminals again. The threat's first version was identified in 2015, but it appears to be making a comeback in 2020 with a new and threatening update. Malware researchers who analyzed Grelos Skimmer's execution report that the latest update shares many similarities with the infamous MageCart group's strategies.

The Grelos Skimmer is a typical JavaScript-based skimmer that can only be planted if its operators discover a vulnerability in their target's website. The typical targets of skimmers like Grelos are eCommerce websites selling products and services. By compromising their website's security and planting the hidden skimmer code, they may be able to gain access to the financial data of hundreds of customers. Of course, neither the site owner nor the customers will be aware of the issue until it is too late.

It seems that the cybercrime groups involved in online skimming are sharing members and infrastructure, judging by the similarities found in the behavior of the MageCart skimmer and the Grelos Skimmer. Usually, the activity of such gangs increases dramatically during Black Friday and the upcoming winter holidays – these are the two periods that attract millions of online shoppers. If you plan on doing some online shopping, you should always stick to trustworthy vendors and remember to stay away from unknown sites.