MageCart
Magecart is a web-skimming/e-skimming malware family and umbrella term for client-side payment-card theft from e-commerce sites. It is also referred to in the content as digital skimming, web skimming, e-skimming, and formjacking. The malware is typically delivered by injecting malicious JavaScript into legitimate online stores or third-party dependencies after attackers gain access through vulnerabilities, misconfigurations, phishing, stolen credentials, compromised plugins/extensions, writable cloud storage, or supply-chain compromises. It commonly targets checkout flows on Magento/Adobe Commerce, WooCommerce/WordPress, Salesforce Commerce Cloud, and other e-commerce environments.
Its core behavior is to monitor checkout pages, intercept payment form interaction, and steal cardholder data in real time before or during submission to the legitimate processor. Reported data theft includes payment card number, expiration date, CVV/CVC, cardholder name, billing address, shipping address, email address, phone number, and other form data. Multiple campaigns described in the content use fake payment overlays or spoofed Stripe/Redsys/PayPlug forms, hide or replace legitimate payment forms, hook checkout buttons or form events, and then restore the legitimate flow so the purchase may still proceed or fail with a deceptive payment error. Some variants also harvested credentials and all typed form input, and one campaign pushed Android APK downloads to mobile users.
Observed evasion and tradecraft include heavy JavaScript obfuscation, delayed or staged loaders, use of trusted infrastructure such as Google Tag Manager, Stripe API, Google Firestore, and analytics-like domains, fake Google Analytics/Tag Manager code, inline SVG payloads with atob() and setTimeout execution, MutationObserver-based triggering, self-removal when the WordPress admin bar is present, localStorage markers to avoid repeat skimming, WebSocket-based exfiltration, image-beacon exfiltration, hidden iframe fallback exfiltration, and exfiltration paths disguised as analytics traffic such as /fb_metrics.php. Reported data protection/exfiltration methods include XOR obfuscation or encryption, including variants using XOR with keys such as "script" or 777, Base64 encoding, local storage staging, storage in .jpg files, fake Stripe customer records, HTTP POST, WebSocket channels, and attacker-controlled domains.
The content associates Magecart activity with organized cybercrime and multiple long-running campaigns rather than a single actor. Named reporting and research sources in the content include Sansec, Silent Push, RiskIQ, Volexity, ANY.RUN, Sucuri, Malwarebytes, Recorded Future, and Bleeping Computer. The malware has been linked in the content to compromises affecting or targeting Magento stores, WooCommerce stores, Claire’s, Ticketmaster, Newegg, and other online retailers, as well as campaigns abusing third-party suppliers such as Inbenta, SociaPlus, PushAssist, Clarity Connect, Annex Cloud, and ConnectPOS.
High-confidence indicators and infrastructure explicitly mentioned in the content include analytics-reports[.]com/wss/jquery-lib.js, wss://protect-wss[.]com/ws, cc-analytics.com, pstatics.com, js-csp.com/getInjector/, artrabol.com, js-stats.com, js-tag.com, redsysgate[.]com, jquerybootstrap[.]com, newassetspro[.]com, assetsbundle[.]com, claires-assets.com, webfotce[.]me/js/form.js, neweggstats.com, cdn-cookie[.]com, lasorie[.]com, statistics-for-you.com, morningflexpleasure.com, and IP address 23.137.249.67. Additional artifacts mentioned include suspicious SVG onload code with atob(), the localStorage key _mgx_cv, and use of wc_cart_hash as a skimming flag.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SessionReaper (CVE-2025-54236) is an unauthenticated, remote-code-execution flaw in Adobe Commerce / Magento that stems from nested deserialization in admin-facing functionality. Sansec’s forensics team said it blocked hundreds of real-world exploitation attempts of the SessionReaper bug as proof-of-concept code and a technical write-up circulated publicly.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesThose include a large number of cybercrime forums and stolen credit card shops, ransomware download sites, Magecart-related infrastructure, and a metric boatload of phishing Web sites...
The entire malicious activity relies on Google Tag Manager and Stripe domains - googletagmanager.com and api.stripe.com - that are trusted implicitly by online stores.
Execution
1 techniqueFrom the metadata fields of the record, it reads JavaScript code that it reassembles and then executes using new Function().
Stealth
3 techniquesThe stolen data is concatenated into a single string, obfuscated using the XOR operation, and stored locally instead of immediately exfiltrated.
The attacker appears to have imitated the Heartbeat API to avoid detection while sniffing the billing information. Heartbeat is originally a WordPress API that provides real-time communication with the server.
Once the data is copied, the local file is wiped to eliminate traces of the attack and prevent duplicate uploads.
Credential Access
2 techniquesThe card skimmer targets Magento/Adobe Commerce checkout pages and attempts to capture payment data (credit card number, expiration date, CVV code, customer name) as well as billing and email addresses, and phone number.
Collection
2 techniquesThe card skimmer targets Magento/Adobe Commerce checkout pages and attempts to capture payment data (credit card number, expiration date, CVV code, customer name) as well as billing and email addresses, and phone number.
Exfiltration
2 techniquesThe attacker used an Ajax request within Heartbeat API in one of the functions in injected Javascript file to send data, which helped them bypass detection.
Every stolen payment card becomes a fake customer record in the attacker's Stripe account, turning Stripe into a storage backend for stolen data.
Impact
2 techniquesThe code checks for user payment information and generates a random password to encrypt the payment details. The encrypted data is then dumped into an image file (.jpg) and made easily accessible. What is concerning about this attack is that the attackers took additional steps to encrypt the data with a public key in PEM format and a randomly generated string...
The attackers tampered with the primary file of the plugin (./wp-content/plugins/woocommerce-gateway-authorize-net-cim/class-wc-authorize-net-cim.php) and injected malicious code that steals payment information from users.
IOCs tracked for this family
80 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Web-based payment card skimmer used to steal checkout data from e-commerce sites. In this campaign it loads via Google Tag Manager, captures payment and customer information from Magento/Adobe Commerce checkout pages, obfuscates the data with XOR, stores it locally, and exfiltrates it via fake customer records in an attacker-controlled Stripe account; a variant uses Google Firestore for storage.
A web-based payment skimming threat associated with injecting malicious scripts into ecommerce checkout pages to steal credit card numbers, CVVs, billing addresses, and other personal details.
Magecart is described as an e-skimmer used to steal payment card data from online shopping sites.
Web-based payment skimmer used against Magento e-commerce stores to steal checkout and billing card data. In this campaign it hides malicious code inside an inline SVG onload attribute, presents a fake secure checkout overlay, captures payment details, encrypts them with XOR plus base64, and exfiltrates the data to attacker-controlled domains before redirecting victims back to the legitimate checkout flow.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.