GrelosGTM is a threat actor group that exploits Google Tag Manager's legitimate script injection capabilities to compromise e-commerce sites, particularly those using Magento CMS. The attack involves injecting custom Google Tag Manager scripts that establish WebSocket connections to load multi-stage JavaScript payloads. The ultimate payload is a sophisticated, obfuscated JavaScript sniffer designed to capture payment card data during the checkout process via fake payment forms. This stolen data is then sent to attacker-controlled infrastructure. The campaign has been active since early 2020 and has targeted at least seven e-commerce websites in multiple countries.

The attack results in the theft of customers' payment card information during the checkout process on compromised e-commerce websites. This can lead to financial fraud, loss of customer trust, and reputational damage for affected businesses. The use of legitimate Google Tag Manager functionality makes detection and prevention more challenging.

No official patches or fixes are indicated for this threat as it exploits legitimate Google Tag Manager functionality rather than a software vulnerability. Mitigation should focus on securing Google Tag Manager accounts and configurations, including strict access controls, monitoring for unauthorized script changes, and validating all injected scripts. E-commerce site operators should review and restrict Google Tag Manager permissions and audit tags regularly. Since this is an abuse of legitimate features, vendor-managed fixes are not applicable.