Loading malware…
Magecart is an umbrella term for multiple financially motivated threat groups and the JavaScript-based web skimming malware they deploy against e-commerce environments. Magecart operations compromise online stores, payment portals, and related checkout infrastructure by injecting malicious client-side code into payment pages, third-party tags, locally hosted libraries, plugins, themes, or other web assets. The malware is designed to capture payment card data and associated customer information entered during checkout, including card numbers, expiration dates, CVVs, names, billing addresses, email addresses, phone numbers, and other form data, then exfiltrate that information to attacker-controlled infrastructure.
Magecart activity has affected a wide range of platforms and ecosystems, including Magento and Adobe Commerce, WooCommerce on WordPress, PrestaShop, Volusion, X-Cart, and government payment portals such as Click2Gov. Infection vectors include direct compromise of merchant websites, tampering with checkout plugins, abuse of public AJAX endpoints, modification of legitimate JavaScript libraries, insertion into Google Tag Manager containers, abuse of trusted third-party infrastructure such as Stripe and GitHub, and hybrid client-side/server-side skimming designs that stage stolen data through the victim site before forwarding it externally. Some campaigns also hide payloads in benign-looking assets such as PNG images or disguise skimmers as analytics, tag-management, or CDN resources.
Observed Magecart variants commonly activate only on checkout-related pages, hook payment form events, inject fake payment forms, overlay legitimate payment interfaces, or dynamically map and harvest input fields. Many samples use obfuscation, anti-debugging, integrity checks, local or session storage, deduplication logic, delayed exfiltration, or self-removal to evade detection and prolong dwell time. Exfiltration methods have included HTTP POST, image beacons, navigator.sendBeacon, WebSocket communications, same-site staging scripts, and abuse of external service backends.
Magecart is primarily associated with payment-card theft and broader e-skimming fraud rather than destructive or disruptive objectives. Stolen data is typically monetized through carding marketplaces and related fraud ecosystems. Public reporting has linked specific clusters and campaigns to multiple distinct Magecart groups, including activity associated with FIN6 in some cases, but the term itself remains a collective label rather than a single malware family or actor. The principal targets are online retailers and any organization operating web-based payment workflows, with victims ranging from small merchants to major retail brands and public-sector payment sites.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
We discovered that the online credit card skimming attack known as Magecart or E-Skimming was actively operating on 3,126 online shops.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Those include a large number of cybercrime forums and stolen credit card shops, ransomware download sites, Magecart-related infrastructure, and a metric boatload of phishing Web sites...
attackers chose to inject content into real .png files — both on compromised sites and in booby trapped Magento repos on GitHub.
The entire malicious activity relies on Google Tag Manager and Stripe domains - googletagmanager.com and api.stripe.com - that are trusted implicitly by online stores.
you’ll notice that it loads contents of the image file and then executes part of it ( x.slice(-34905) ) as a JavaScript function.
The stolen data is concatenated into a single string, obfuscated using the XOR operation, and stored locally instead of immediately exfiltrated.
After the end of the last chunk (IEND), we can see JavaScript code. This code is ignored by image viewers, but you can access it if you work with the .png file as if it was a regular text file.
Spécialiste de l’injection de code malveillant dans des scripts légitimes (ex : bibliothèque SVG Raphaël.js avec un IIFE de 1 225 caractères inséré).
Once the data is copied, the local file is wiped to eliminate traces of the attack and prevent duplicate uploads.
Like other JavaScript skimmers, Pipka is injected into websites to steal data that’s entered into online payment forms on e-commerce websites. When a visitor goes to that website, the skimmer will then scoop up personal details entered on the site – including payment-card information such as payment account number, expiration date, three-digit Card Verification Value (CVV) and the cardholder’s name and address.
“The downloaded code waits until the shopper chooses a card-payment option, then places a convincing form over the real payment area. It can collect the card number, expiry date, CVV, cardholder name, billing email, and other checkout details.”
Like other JavaScript skimmers, Pipka is injected into websites to steal data that’s entered into online payment forms on e-commerce websites. When a visitor goes to that website, the skimmer will then scoop up personal details entered on the site – including payment-card information such as payment account number, expiration date, three-digit Card Verification Value (CVV) and the cardholder’s name and address.
“The downloaded code waits until the shopper chooses a card-payment option, then places a convincing form over the real payment area. It can collect the card number, expiry date, CVV, cardholder name, billing email, and other checkout details.”
“The contract returns a disposable delivery-domain name, which the loader combines with a pre-set path to download the final skimmer.”
“It can collect the card number, expiry date, CVV, cardholder name, billing email, and other checkout details, then sends the information out in Base64-encoded form.”
“It can collect the card number, expiry date, CVV, cardholder name, billing email, and other checkout details, then sends the information out in Base64-encoded form.”
the script creates a new image tag with the src attribute pointing to the /get.php file on the same compromised site. The stolen data is passed along as GET parameters to that image.
we retrieved this exfiltration gate URL: “hxxps:// fontsgoogle-apis[.]com/v14/ “.
Every stolen payment card becomes a fake customer record in the attacker's Stripe account, turning Stripe into a storage backend for stolen data.
The code checks for user payment information and generates a random password to encrypt the payment details. The encrypted data is then dumped into an image file (.jpg) and made easily accessible. What is concerning about this attack is that the attackers took additional steps to encrypt the data with a public key in PEM format and a randomly generated string...
The attackers tampered with the primary file of the plugin (./wp-content/plugins/woocommerce-gateway-authorize-net-cim/class-wc-authorize-net-cim.php) and injected malicious code that steals payment information from users.
225 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.