VaultSkim web skimmer
VaultSkim is a checkout skimmer that hides its form collector and sending routine in RC4-encrypted bytecode. We have matched it on 89 sites since 21 September.
VaultSkim in numbers
Since 21 September, the first VaultSkim match in our records, counted on 12 November 2026. How we count.
| Sites with VaultSkim code | 89 |
|---|---|
| Sites with a match in the last 30 days | 62 |
| New sites in October | 19 |
| Sites captured since 25 September | 60 |
The checkout collector sits inside encrypted bytecode
VaultSkim's script is embedded in the store's HTML. It Base64-decodes encrypted program blobs, decrypts them with RC4, parses the result as JSON and runs the instructions through a bytecode interpreter. The checkout selector and collector address are inside those blobs.
The decoded program installs a document click handler. It watches for a submit button with the ID checkout-step-3-btn, finds the checkout form and collects its values through FormData. The collection routine filters out file values before serialising the entries.
Form values leave through /rbm
VaultSkim encodes the form data and sends it to hxxps://js-static[.]com/rbm. The sending routine uses navigator.sendBeacon or a fetch POST with keepalive enabled, so the request can continue while the browser leaves the page.
A search of the page source for the collector URL finds nothing until the program blobs are decrypted.
What we see
| Month | New sites |
|---|---|
| September | 70 |
| October | 19 |
| November so far | 0 |
We captured 60 VaultSkim sites since 25 September.
Checking a checkout
Use a test checkout and preserve its HTML, scripts and network log. Look for:
- a large inline script with Base64 program blobs, an RC4 decoder and a bytecode interpreter
- JSON parsing immediately after decryption
- a click handler targeting
checkout-step-3-btnand collecting the form throughFormData - beacon or POST requests to
js-static[.]com/rbm
Remove the injected script and restore changed templates or bundles from a trusted deployment. Review access to the store and hosting account, rotate credentials, clear server and CDN caches, then test the checkout again while watching outgoing requests.