GrelosGTM Google Tag Manager Skimmer: Magento Checkout JS Sniffer + WebSocket Exfil Detection Pack

Threat Summary

The OTX pulse describes GrelosGTM, a financially motivated web-skimming crew targeting retail e-commerce properties, especially Magento CMS storefronts in the United States, Belgium, Italy, and the United Kingdom. The core tradecraft is not a noisy server-side ransomware event; it is quiet checkout-page manipulation. The operators abuse the trust placed in Google Tag Manager and tag-manager style delivery to get attacker-controlled JavaScript executed in the victim browser at the exact moment payment and personal data are entered.

The collective signal points to an e-commerce skimming chain: obtain write access or plugin/theme-level influence over a Magento store, inject a malicious GTM loader or GTM-looking script, stage a JavaScript sniffer in the checkout flow, hook form input and payment fields, then move stolen card data through browser-side channels such as WebSocket or HTTP beacons to attacker infrastructure. The listed infrastructure is domain-centric and uses plausible or throwaway names such as jqwereid.online, fountm.online, gstatcs.com, webfaset.com, and bulder.online. Treat the pulse as a revalidated or recirculated campaign artifact: the description references activity first observed in 2020-2021, while the pulse metadata is current, so validate present-day resolution and ownership before destructive blocking while still hunting aggressively for historical and recent exposure.

Likely ATT&CK mapping for detections: T1189 Drive-by Compromise for victim-side script delivery, T1059.007 JavaScript execution in browser context, T1102 Web Service abuse through legitimate tag-manager functionality, T1056 Input Capture through checkout form hooking, T1071.001 Web Protocols and T1041 Exfiltration Over C2 Channel for payment data movement, and T1027 Obfuscation for packed or encoded sniffers.

Threat Actor / Malware Profile

Adversary: GrelosGTM. Objective: payment card theft and customer PII harvesting from retail checkout pages. The malware family is a JavaScript sniffer rather than a conventional binary implant. Distribution is achieved by compromising or abusing the e-commerce web stack: Magento admin credential theft, vulnerable extensions, theme or layout updates, database configuration changes, compromised third-party scripts, or direct modification of templates that emit GTM snippets.

Payload behavior: browser execution on checkout and payment pages; DOM form discovery; capture of card number, expiry, CVV, billing address, email, and session tokens; staged encoding with atob, btoa, String.fromCharCode, array joins, or XOR-like routines; gated execution so the skimmer only activates on checkout paths; and beaconing only after field completion to reduce noise.

C2 communication: outbound browser-initiated connections to attacker domains over HTTPS or WebSocket. The pulse tag websocket injector is important: WebSocket exfil can blend with legitimate analytics and chat stacks and may not appear as classic POST theft unless TLS inspection, browser telemetry, or egress domain analytics are present.

Persistence: persisted through content change rather than endpoint persistence. Expect malicious GTM container IDs in CMS configuration, Magento core_config_data entries, layout XML, CMS blocks, theme templates, minified JS in pub/static, injected service-worker or tag code, and cron/scheduled tasks that restore tampered files after cleanup.

Anti-analysis: checkout-path gating, referrer checks, one-time beacon domains, typosquatted or analytics-looking names such as gstatcs.com, delayed execution, devtools detection, payload splitting between HTML and remote script, and use of legitimate tag-manager patterns to make malicious loads look administratively normal.

IOC Analysis

The pulse contains five domain indicators and no file hashes or IPs. This means the highest-value controls are DNS, egress web filtering, TLS SNI inspection where legal, browser or CDN script integrity monitoring, and web content change detection. Domains should be operationalized in three layers: exact-match blocking for jqwereid.online, fountm.online, gstatcs.com, webfaset.com, and bulder.online; analytics to catch lookalikes and fresh .online or analytics-sounding domains; and retrospective search across DNS resolver logs, proxy/ZTNA logs, WAF/CDN logs, Magento access logs, EDR network events, and browser extension or CSP telemetry.

Do not rely only on domain blocking. GTM abuse means the first-stage may be a legitimate googletagmanager.com load with a rogue container ID, while the second-stage is attacker infrastructure. SOC teams should baseline approved GTM container IDs, alert on new GTM- IDs outside change windows, and correlate CMS admin changes with subsequent checkout script modifications. Useful tooling: Magento integrity scans and bin/magento config:show review, CSP report-only to catch unexpected script-src and connect-src, WAF/CDN body or script-hash allowlisting, DNS RPZ, EDR network connection hunting, YARA on exported JS for WebSocket plus payment-form terms, and sandbox rendering of checkout pages with synthetic transactions to observe beacons.

Detection Engineering

Use these as starting detections and tune approved GTM IDs, web roots, hostnames, and CMS paths before broad enforcement.

---
title: GrelosGTM IOC Domain Network Connection
id: 9f4db0a1-6f3f-4a8f-9f42-grelosgtm001
status: experimental
description: Detects endpoint, server, or browser-initiated network connections to GrelosGTM web-skimming domains listed in OTX pulse.
author: Security Arsenal
date: 2026/09/15
logsource:
  category: network_connection
detection:
  selection_domains:
    DestinationHostname|contains:
      - 'jqwereid.online'
      - 'fountm.online'
      - 'gstatcs.com'
      - 'webfaset.com'
      - 'bulder.online'
  condition: selection_domains
fields:
  - DestinationHostname
  - DestinationIp
  - DestinationPort
  - Initiated
  - User
falsepositives:
  - Threat intel validation lookups by analysts
level: high
tags:
  - attack.t1071.001
  - attack.t1041
  - attack.t1102
---
title: Unapproved Google Tag Manager Container On E-Commerce Checkout
id: 0d9d9f47-1d7d-4bb1-9d61-grelosgtm002
status: experimental
description: Detects web requests for GTM loader or checkout script activity outside approved container IDs and change windows. Replace GTM-APPROVED1 and approved hosts.
author: Security Arsenal
date: 2026/09/15
logsource:
  category: webserver
detection:
  selection_gtm:
    cs-uri-query|contains:
      - '/gtm.js?id=GTM-'
      - 'gtm.js?id=GTM-'
  selection_checkout:
    cs-referer|contains:
      - 'checkout'
      - 'payment'
      - 'onepage'
      - 'multishipping'
  filter_approved:
    cs-uri-query|contains:
      - 'GTM-APPROVED1'
      - 'GTM-APPROVED2'
  condition: selection_gtm and selection_checkout and not filter_approved
fields:
  - c-ip
  - cs-host
  - cs-uri-stem
  - cs-uri-query
  - cs-referer
  - sc-status
falsepositives:
  - Legitimate marketing tag releases not yet added to allowlist
level: medium
tags:
  - attack.t1189
  - attack.t1059.007
  - attack.t1102
---
title: Suspicious Write To Magento Webroot Or Config Path
id: 7c85e613-f5fd-4c31-8f17-grelosgtm003
status: experimental
description: Detects shell, interpreter, or utility writes to Magento code, template, static, or config locations consistent with skimmer injection or persistence restoration.
author: Security Arsenal
date: 2026/09/15
logsource:
  product: linux
  category: process_creation
detection:
  selection_paths:
    CommandLine|contains:
      - '/app/etc/'
      - '/pub/static/'
      - '/app/code/'
      - '/app/design/'
      - '/generated/code/'
      - 'core_config_data'
      - 'cms_block'
      - 'cms_page'
  selection_writers:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/php'
      - '/php-fpm'
      - '/perl'
      - '/python'
      - '/python3'
      - '/node'
      - '/sed'
      - '/tee'
      - '/curl'
      - '/wget'
  filter_maintenance:
    CommandLine|contains:
      - 'bin/magento setup:upgrade'
      - 'bin/magento setup:di:compile'
      - 'bin/magento cache:flush'
  condition: selection_paths and selection_writers and not filter_maintenance
fields:
  - CommandLine
  - Image
  - ParentCommandLine
  - User
  - CurrentDirectory
falsepositives:
  - Deployment pipelines, theme compilation, Magento maintenance
level: high
tags:
  - attack.t1505.003
  - attack.t1027
  - attack.t1059

let GrelosDomains = dynamic(['jqwereid.online','fountm.online','gstatcs.com','webfaset.com','bulder.online']);
let SkimTerms = dynamic(['WebSocket','new WebSocket','gtm.js?id=GTM-','atob(','btoa(','fromCharCode','checkout','payment','cc-number','core_config_data','pub/static','app/etc/local.xml']);
let NetHits =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl has_any (GrelosDomains) or InitiatingProcessCommandLine has_any (GrelosDomains)
    | extend EvidenceType = 'network', Evidence = coalesce(RemoteUrl, InitiatingProcessCommandLine)
    | project Timestamp, DeviceName, EvidenceType, Evidence, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId;
let ProcHits =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where ProcessCommandLine has_any (GrelosDomains) or (ProcessCommandLine has_any (SkimTerms) and FileName in~ ('php','php-fpm','node','curl','wget','bash','sh','perl','python','python3'))
    | extend EvidenceType = 'process', Evidence = ProcessCommandLine
    | project Timestamp, DeviceName, EvidenceType, Evidence, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId;
union NetHits, ProcHits
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hits=count(), Evidence=make_set(Evidence, 10) by DeviceName, EvidenceType, bin(Timestamp, 1h)
| order by LastSeen desc;

#!/usr/bin/env bash
# Read-only GrelosGTM hunt for Magento/Linux web tiers. Run as root or with sudo.
WEBROOTS=${WEBROOTS:-'/var/www/html /srv/www /home/*/public_html'}
LOGS=${LOGS:-'/var/log/nginx /var/log/apache2 /var/log/httpd /var/log/syslog /var/log/messages'}
IOC_FILE=$(mktemp)
cat > "$IOC_FILE" <<'EOF'
jqwereid.online
fountm.online
gstatcs.com
webfaset.com
bulder.online
EOF

printf '\n== Fixed-string IOC grep in webroots ==\n'
for root in $WEBROOTS; do
  [ -d "$root" ] || continue
  grep -RInF -f "$IOC_FILE" "$root" 2>/dev/null | head -200
done

printf '\n== Recent Magento file changes, last 14 days ==\n'
for root in $WEBROOTS; do
  [ -d "$root" ] || continue
  find "$root" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.js' -o -name '*.xml' -o -name '*.html' \) -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM %p\n' 2>/dev/null | sort | head -300
done

printf '\n== Suspicious checkout script terms in webroots ==\n'
for term in 'new WebSocket' 'WebSocket(' 'gtm.js?id=GTM-' 'atob(' 'fromCharCode' 'core_config_data' 'cc-number' 'cardnumber' 'paymentMethod'; do
  printf '\n-- %s --\n' "$term"
  for root in $WEBROOTS; do
    [ -d "$root" ] || continue
    grep -RInF -e "$term" "$root" 2>/dev/null | head -80
  done
done

printf '\n== Persistence review: cron, systemd timers, Magento cron ==\n'
crontab -l 2>/dev/null
for u in $(cut -d: -f1 /etc/passwd); do crontab -u "$u" -l 2>/dev/null | sed "s/^/user=$u /"; done
ls -l /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null
systemctl list-timers --all 2>/dev/null | head -100
for root in $WEBROOTS; do [ -f "$root/cron.php" ] && printf 'Magento cron present: %s/cron.php\n' "$root"; done

printf '\n== Log hits for IOCs and rogue GTM loads ==\n'
for path in $LOGS; do
  [ -d "$path" ] || continue
  grep -RInF -f "$IOC_FILE" "$path" 2>/dev/null | head -200
  grep -RInF -e 'gtm.js?id=GTM-' "$path" 2>/dev/null | head -100
done

printf '\n== Live resolution and established egress check ==\n'
while read -r d; do
  [ -n "$d" ] || continue
  ip=$(getent ahostsv4 "$d" 2>/dev/null | awk 'NR==1{print $1}')
  printf '%s resolves %s\n' "$d" "${ip:-none}"
  [ -n "$ip" ] && ss -tanp 2>/dev/null | grep -F "$ip"
done < "$IOC_FILE"
rm -f "$IOC_FILE"

Response Priorities

Immediate: add the five domains to DNS RPZ, secure web gateway, EDR custom indicators, WAF/CDN egress rules, and mail/web detonation watchlists; search 30-90 days back for hits; put checkout pages under CSP report-only with tight script-src and connect-src; capture a clean checkout render and compare against production to identify injected GTM IDs, WebSocket endpoints, and obfuscated sniffers; snapshot Magento config tables, CMS blocks, layout files, pub/static hashes, and admin audit logs before remediation.

24h: rotate Magento admin, database, SSH, deployment, CDN, and third-party tag-manager credentials; enforce phishing-resistant MFA for admin and vendor accounts; invalidate customer sessions where skimming is confirmed and prepare card-brand/PCI notification workflow; review new admin users, API tokens, OAuth consumers, integration keys, GTM container publish history, and extension installs; if payment data exposure is confirmed, involve PCI forensic investigator requirements and legal counsel early rather than after cleanup.

1 week: move tag changes behind change control with dual approval and container ID allowlisting; deploy file integrity monitoring on app/etc, app/design, app/code, pub/static, generated/code, and theme assets; separate deployment identity from runtime PHP-FPM identity; disable write access from web user to code paths; require signed deployment artifacts; add WAF virtual patching for Magento admin and extension exploit paths; build dashboards for first-seen script hosts, new connect-src destinations, checkout DOM mutation anomalies, and out-of-hours CMS changes; run a compromise assessment for adjacent stores sharing credentials, extensions, CDN accounts, or agencies.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub