The threat actor claims to be selling a payment-card skimming malware on e-commerce shops in the US and Canada to steal customers’ payment information.