A year of Source Defense Research on how eSkimming evolved in 2025, and what security teams should do next.

Throughout 2025, Source Defense Research tracked an evolution in eSkimming sophistication. Attacks are getting harder to spot and easier to scale, adversaries are evolving rapidly and launching campaigns designed to evade common controls and blend into normal web traffic.

This free report breaks down what we observed across the year including:

• A late year, globally coordinated operation built on 52 distinct malicious scripts, spanning 12 primary domains and 9+ languages. We anticipate early year breach disclosures.
• 92+ distinct campaigns discovered – targeting thousands of ecommerce sites. It is impossible to quantify how many more went undetected.
• Alarming evolution of tradecraft with campaigns designed to evade controls in PCI DSS 4.0.1; with scope of attacks far beyond payment pages; with new techniques for iFrame bypass
• Emboldened adversaries taking advantage of the fact that a majority of merchants still have not addressed eSkimming controls
• Heavy abuse of trusted services like Google Tag Manager, BunnyCDN, Vercel, CodePen, and Discord
• Rapid rise of new techniques: double-entry attacks, silent skimming, and newer tactics like payment method injection that can create attack surfaces where none existed.

Recommended for security, IT, GRC, and eCommerce teams responsible for payment security, fraud prevention , PCI DSS Compliance and third-party script risk.