Loading story…
A Magecart campaign compromised 3,126 online shops hosted on Volusion’s cloud e-commerce platform by tampering with the vnav.js JavaScript library used during checkout. The injected code loaded a second-stage skimmer from Google Storage, captured payment and personal information entered by customers, obfuscated the data, stored it in browser sessionStorage, and later exfiltrated it with HTTP POST requests to the lookalike domain volusion-cdn[.]com. Volusion said a limited subset of merchant customer information, including credit card data, was exposed.
Researchers linked the operation to Magecart Group 6 / FIN6 based on code and infrastructure overlaps with earlier e-skimming incidents involving British Airways and Newegg. The campaign reflected broader web-skimming tradecraft in which attackers inject malicious JavaScript into trusted payment pages to silently harvest checkout data at scale. Google removed the hosted malicious file, and Volusion acknowledged the compromise and said it had fixed the issue.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that the e-skimming campaign targeting Volusion’s cloud e-commerce platform began on September 7, 2019. The operation ultimately affected 3,126 online shops by injecting malicious code into Volusion’s vnav.js library.
Trend Micro published technical analysis attributing the Volusion e-skimming operation to Magecart Group 6, also known as FIN6, based on code, infrastructure, and modus operandi similarities with earlier British Airways and Newegg attacks.
Volusion acknowledged the compromise and stated it resolved the issue within a few hours of notification. The company said a limited subset of merchant customer information, including credit card data, had been compromised.
After being contacted, Google removed the malicious JavaScript file hosted at a Google Storage URL that served as the second-stage skimmer. By the time of publication, this takedown had rendered the attack offline.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourceriskiq.com
Open sourceriskiq.com
Open sourceniccs.us-cert.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a broader **Magecart 12** web-skimming operation to the domain `jquerycdn.su`, identifying dozens of compromised online stores where malicious JavaScript was injected to steal shoppers’ payment data. The campaign was observed from at least late 2019 into early 2020, and investigators said many affected sites were still infected even after the skimmer infrastructure temporarily went offline. Any payment information entered on impacted checkout pages during the exposure window was assessed as potentially compromised. Analysis of the malware showed the skimmer evolved through at least four iterations while keeping a consistent obfuscation style associated with earlier Magecart 12 activity. Earlier variants used a first-stage payload padded with garbage code, while newer versions expanded collection beyond standard payment forms to harvest **all fields on a page**, increasing the amount of customer data that could be captured. Researchers also tied the exfiltration infrastructure to other Magecart 12 campaigns, indicating a sustained and adaptable card-theft operation targeting e-commerce platforms.
Aug 15, 2026
A large Magecart campaign compromised nearly 100 Magento and Adobe Commerce stores by hiding a full credit-card skimmer inside a **1x1-pixel SVG** embedded directly in checkout page HTML. Researchers said the malware stores its payload in the SVG `onload` handler, decodes it with `atob()`, and runs it via `setTimeout`, allowing it to evade scanners that typically look for externally loaded scripts. When shoppers click checkout, the skimmer displays a convincing fake **"Secure Checkout"** overlay that captures billing and payment details before validating card numbers with the **Luhn algorithm**. The stolen data is exfiltrated as XOR-encrypted, base64-obfuscated JSON to attacker-controlled infrastructure, in some cases disguised as Facebook analytics traffic. Sansec linked the infections to exploitation of the **PolyShell** vulnerability, which affects Magento Open Source and Adobe Commerce stable version 2 deployments and can enable unauthenticated code execution and account takeover. Defenders were urged to hunt for hidden SVG tags and suspicious `onload` code, check for the `_mgx_cv` localStorage key, and block outbound traffic to the identified attacker infrastructure, including domains resolving to **`23.137.249.67`** hosted by IncogNet in the Netherlands.
Jun 29, 2026
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026