Fullz House

Profile narrative

Fullz House is a threat actor known by that alias and has been linked to operations originating from Russia. The group primarily targets e‑commerce platforms, as evidenced by compromises of a U.S. mobile virtual network operator’s online store and an online retailer associated with a media production company. Their observed objective is financial gain, specifically the theft of payment card data and personal information from customers during checkout processes.

The actor’s tactics involve injecting malicious JavaScript into compromised websites, often disguising the script as a legitimate Google Analytics library hosted on an external domain. This skimmer monitors input fields for changes, harvesting card details in real time and exfiltrating the data via Base64‑encoded GET requests. In addition to pure skimming, Fullz House repurposes the same script to redirect victims to fraudulent payment pages that mimic legitimate financial interfaces, capturing submitted information before sending users back to the genuine checkout. The group has also employed geographically tailored phishing domains to impersonate payment processors, a technique seen in the Rooster Teeth incident. Publicly reported campaigns include the 2020 compromise of Boom! Mobile’s shopping cart platform and the 2019 breach of Rooster Teeth Productions’ online store, both of which resulted in the collection of customer payment and personal data through a combination of web skimming and deceptive redirection. No public attribution to state sponsors or criminal consortia has been established beyond the geographic association with Russia.

Incidents

Attributed incidents are available to members.