Checkout form submission to GrelosGTM skimmer domains
Detects outbound HTTP/POST requests from checkout or payment page environments to known malicious domains associated with GrelosGTM digital skimmer infrastructure. This behavior is indicative of unauthorized data exfiltration, where payment information is sent to an attacker-controlled server instead of the legitimate payment gateway.
Microsoft Sentinel (KQL)
