Group-IB links Lazarus to BTC Changer, a modified JavaScript sniffer campaign that shifted from stealing payment-card data to stealing cryptocurrency payments from e-commerce sites. The researchers connect BTC Changer to the earlier clientToken= infrastructure by shared compromised websites and similar script functions, while noting that the new version replaced shop BTC or ETH destination addresses with attacker-controlled wallets. The campaign affected online stores including Realchems and Wongs Jewellers, and reused luxmodelagency[.]com to host malicious JavaScript. Group-IB also observed a fake payment form opened in an iframe and a Korean-locale artifact in the saved form, adding attribution context to the Lazarus assessment.