Get started in 5 minutes!

Payment skimmers have impersonated Sansec

Payment skimmers have impersonated Sansec

Payment skimmers are hiding their malpractice by impersonating our Sansec anti-skimming service. They have registered malicious domains and, even using a fake address in Amsterdam to make it look legitimate. Here is the fraud registration record:

Domain Name:
Creation Date: 2019-10-27T12:04:51Z
Registrant Name: William De Groot
Registrant Organization: Sansec ltd
Registrant Street: Damrak 101
Registrant City: Amsterdam
Registrant State/Province: Noord-Holland
Registrant Postal Code: 1012 LM
Registrant Country: NL
Registrant Phone: +31.0687354774
Registrant Email: [email protected]
Name Server:
Name Server:

For the sake of clarity: our own domain name is, nothing else.

As you can see, their infrastructure is in Russia, which slightly gives it away. Their payment skimmer is loaded as “protection” such as this:

Advanced anti reverse engineering

These fake “Sansec” skimmers have been injected on a number of high profile stores, harvesting the peak of transactions at Black Friday. Not all malware uses a “Sansec-themed” domain name, but all of the big ones share identical code and infrastructure.

A notable example is stock-listed Smith & Wesson (NYSE). The gun giant caught a skimmer on Wed Nov 27, just in time for Black Friday, and is present at the time of writing. Update Dec 3rd: the skimmer has been removed from the Smith & Wesson store

This skimmer is exceptionally sophisticated, as it features:

  • Multiple anti reverse engineering methods such as devtools, Amazon AWS, country & Linux detection.
  • A 3-stage loader
  • 4 layers of Javascript obfuscation

The loader at serves some innocent code, until you start the actual payment process. It only works for US-based IPs, using non-Linux browsers, and not using the AWS platform. Here, you can see the file size changing from 11 to 20 KB upon entering the checkout section:

The code has multiple levels of obfuscation, each rendering a new anonymous function to complicate debugging.

At stage 3, a fake payment form is constructed. Then another file is loaded from which contains the actual exfiltration code.

Finally, the payments are intercepted and sent to

Acknowledgement: @AffableKraut contributed to this investigation.

Stay ahead of eCommerce hacks,
protect your store today!


Try our malware scanner