Web skimming is a common class of attacks generally aimed at online shoppers. The principle is simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to shoppers payment information. To make the data flow to a third-party resource less visible, fraudsters often register domains resembling the names of popular web services. But attack of this kind were also found to sometimes use Google Analytics.”]
Source: https://securelist.com/web-skimming-with-google-analytics/97414/