The group's skimmer has added some capabilities that steals credentials from admins.

Source