This hunt identifies potential compromise by matching network traffic or asset data against 47 known Indicators of Compromise (IOCs) associated with the vSkimmer malware family. Proactively hunting for these IOCs in Azure Sentinel is critical to detect stealthy credential theft or web skimming activities that may have evaded real-time detections, allowing the SOC to isolate affected endpoints before lateral movement occurs.
Malware Family: vSkimmer Total IOCs: 47 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | js-static.com | payload_delivery | 2026-09-21 | 100% |
| url | hxxps://js-static.com/rbm | payload_delivery | 2026-09-21 | 100% |
| domain | www.stroudbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.thewrightcollection.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.barnerbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.chathambookseller.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.crossroadbookstore.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.doullbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.gastonrenard.com.au | payload_delivery | 2026-09-21 | 100% |
| domain | www.greensleevesbooks.co.uk | payload_delivery | 2026-09-21 | 100% |
| domain | www.jlawton.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.lettersbookshop.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.manyhillsbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.midtownscholar.us | payload_delivery | 2026-09-21 | 100% |
| domain | www.oddballbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.oldscrolls.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.puddletownbookshop.co.uk | payload_delivery | 2026-09-21 | 100% |
| domain | www.rbookmark.com | payload_delivery | 2026-09-21 | 100% |
| domain | www.robertsbookshop.com | payload_delivery | 2026-09-21 | 100% |
| domain | navalandmaritimebooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | needleworkbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | rarechristianbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | readinghabit.com.au | payload_delivery | 2026-09-21 | 100% |
| domain | readinkbooks.com | payload_delivery | 2026-09-21 | 100% |
| domain | remnantbooks.org | payload_delivery | 2026-09-21 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - vSkimmer
let malicious_domains = dynamic(["js-static.com", "www.stroudbooks.com", "www.thewrightcollection.com", "www.barnerbooks.com", "www.chathambookseller.com", "www.crossroadbookstore.com", "www.doullbooks.com", "www.gastonrenard.com.au", "www.greensleevesbooks.co.uk", "www.jlawton.com", "www.lettersbookshop.com", "www.manyhillsbooks.com", "www.midtownscholar.us", "www.oddballbooks.com", "www.oldscrolls.com", "www.puddletownbookshop.co.uk", "www.rbookmark.com", "www.robertsbookshop.com", "navalandmaritimebooks.com", "needleworkbooks.com", "rarechristianbooks.com", "readinghabit.com.au", "readinkbooks.com", "remnantbooks.org", "renaissancebooks.co.nz", "rudolfsteinerbookcentre.com.au", "theridgebooks.com", "vagabondbooks.com", "whitefoxrarebooks.com", "www.adamsanglingbooks.com", "www.adelaidebooksellers.com.au", "www.antiquarianbooks.biz", "www.antiquemallbookstore.com", "www.bagbooks.com", "author-author.net", "bookrackjackson.com", "booksofparadise.net", "brooklynbooks.us", "chaparralbooks.com", "confettibooks.com", "kathmandubooks.com", "kellerbooks.com", "leurabooks.com.au", "mcdowellsemporium.com", "mcinbooks.com", "mysticlink.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - vSkimmer
let malicious_urls = dynamic(["https://js-static.com/rbm"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Dependency on vSkimmer’s Historical C2 Domains
api.skimmer.io or similar) as a fallback endpoint for third-party payment gateway verification or legacy API calls. When the application performs its nightly data sync, it generates outbound traffic to this known IOC, triggering the hunt.10.20.5.10-10.20.5.15) when the destination domain matches the specific vSkimmer IOC, provided the traffic is on port 443 and the user agent string matches the legacy app’s signature.Security Team’s Active Threat Hunting and Validation
curl or a Python script) to verify alerting fidelity. This legitimate test traffic hits the IOC list and generates a high-fidelity alert.sec-test, blue-team, or hunt-validation, or where the source IP is within the designated security lab subnet (e.g., 192.168.100.0/24).Scheduled Backup or Log Shipping to a Third-Party SaaS Using an IOC Domain