EXECUTIVE SUMMARY:
A Magecart-style card-skimming campaign has compromised legitimate e-commerce storefronts and used Ethereum smart contracts to stage malicious payment-skimming code. The campaign primarily affects online shopping platforms, where attackers inject a concealed JavaScript loader into merchant websites and disguise it as a Google Tag Manager component. The loader retrieves the location of the second-stage skimmer from blockchain infrastructure, allowing attackers to steal customers payment information while legitimate purchases continue to complete normally.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A Magecart-style card-skimming campaign has compromised legitimate e-commerce storefronts and used Ethereum smart contracts to stage malicious payment-skimming code. The campaign primarily affects online shopping platforms, where attackers inject a concealed JavaScript loader into merchant websites and disguise it as a Google Tag Manager component. The loader retrieves the location of the second-stage skimmer from blockchain infrastructure, allowing attackers to steal customers payment information while legitimate purchases continue to complete normally.[emaillocker id="1283"]
The attack begins with a server-side compromise of an e-commerce website, where the attackers insert an obfuscated loader into the storefront. The loader imports the legitimate ethers.js library and communicates with a public Ethereum Sepolia RPC endpoint to query an attacker-controlled smart contract. The contract returns a disposable delivery hostname, which the loader combines with a predefined path to download the actual Magecart skimmer. The skimmer overlays or replaces the legitimate checkout payment interface and captures sensitive information including card numbers, expiration dates, CVV values, cardholder names, and billing email addresses. The stolen information is Base64-encoded and transmitted to an attacker-controlled endpoint, after which the original checkout interface is restored so the transaction can proceed without obvious signs of compromise. The use of blockchain-based staging provides persistence and resistance to conventional domain takedowns because the delivery information can be changed through the smart contract.
This campaign demonstrates the continued evolution of Magecart attacks through the adoption of blockchain-based payload staging. By combining compromised merchant infrastructure, disguised JavaScript loaders, disposable delivery domains, and Ethereum smart contracts, attackers can conceal the delivery infrastructure and maintain access to payment data while minimizing visible disruption to shoppers. Organizations operating e-commerce platforms should regularly inspect server-side code and third-party scripts, monitor unexpected Web3 libraries and blockchain RPC requests, validate Google Tag Manager implementations, and investigate unauthorized JavaScript modifications to checkout pages to detect and prevent payment-card skimming.
THREAT PROFILE:
| Tactic | Technique Id | Technique | Sub-technique |
| Execution | T1204.002 | User Execution | Malicious File |
| Collection | T1005 | Data from Local System | - |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
REFERENCES:
The following reports contain further technical details:
https://cybersecuritynews.com/hackers-use-ethereum-blockchain/
https://blog.confiant.com/p/skimming-on-the-blockchain-a-magecart
[/emaillocker]