№ 01 · skimmer
critical
The card skimmer
Magecart-class JavaScript injected into checkout pages, payment forms or third-party assets. Siphons PAN, CVV, billing — straight to a foreign C2 endpoint.
checkout layerjs / php
Blinkincat is a small bureau of e-commerce malware exterminators. We surgically remove card skimmers, web-shells and supply-chain implants from WooCommerce, WordPress, Magento, Joomla, OpenCart, PrestaShop and Shopify storefronts — then quietly stay on watch.
Magecart-class JavaScript injected into checkout pages, payment forms or third-party assets. Siphons PAN, CVV, billing — straight to a foreign C2 endpoint.
Obfuscated PHP or ASP shells dropped via vulnerable plugins, file managers or stolen admin sessions. Full RCE, deep persistence, second doors behind first doors.
Hijacks crypto-pay buttons or paints a convincing "approve" modal. Empties balances on one mis-trusted click. We rip the overlay and reseat the gateway.
Trusted plugins, themes and CDNs that ship malicious code in a routine update. Caught by behavior diffing and signed-hash baselining, not vibes.
Iframe overlays, fake gateways and look-alike checkouts that quietly intercept customers. Forensic teardown plus traffic-flow surgery to seal the route.
Cloaked pharma/casino injections, cron-rewritten content, .htaccess redirects targeting only Googlebot and mobile UAs. Invisible to you, loud to search.
You write. We open a secure channel, accept read-only access, pull a fresh tar & database snapshot — usually under thirty minutes.
0 – 30 minFull file and database diff against clean platform baselines. YARA rules, behavioral signatures, live traffic inspection of the checkout flow.
1 – 6 hrsSurgical payload removal — never touch the legit code, never break the store. Zero-downtime when possible, staging-tested otherwise.
4 – 24 hrsIntegrity monitoring, weekly delta reports, instant alerts if anyone tries to re-implant. We do not ghost after the fix.
ongoingThey pulled a Magecart loader out of a checkout that three other vendors had already "cleaned". Refund volume dropped to zero the next day.
Drop the storefront URL and a one-line description of what feels wrong. We come back inside thirty minutes with a free preliminary look — no access required.