Further examination of a breached checkout page revealed the inclusion of a suspicious script with base64 variables and hex strings that exfiltrate credit card information, as well as names and addresses via the querySelectorAll function, an analysis from Sucuri revealed. Researchers also discovered the usage of a “swapme”

Source: SC Magazine