Loading story…
Researchers found a compromised X-Cart e-commerce site running two separate payment skimmers: a basic server-side stealer and a more advanced client-side JavaScript skimmer. The server-side malware captured base64-encoded payment POST data and saved it to a fake .jpg file, while the browser-based skimmer validated that a credit card number was present before exfiltrating checkout data to attacker infrastructure. Analysts traced the X-Cart exfiltration path to metahtmlhead[.]com/folder/ip/zxc.php, with the destination assembled through DOM-based domain construction to hinder detection.
The JavaScript skimmer used layered obfuscation and an anti-debugging technique tied to wrapper-function length, forcing researchers to brute-force parts of the code to recover its behavior. A similar skimmer was later identified on a Magento 1.x site, using the same obfuscation style and a matching URL path structure but sending stolen payment data to winsiott[.]com/folder/ip/stt.php. The overlap in code design, evasion methods, and infrastructure indicates a broader web-skimming campaign targeting multiple e-commerce platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The domain metahtmlhead[.]com, later used by the X-Cart skimmer for exfiltration, was registered.
The domain winsiott[.]com, later used by a related Magento skimmer variant for data exfiltration, was registered.
PublicWWW identified additional infected sites hosting skimmer variations that used winsiott[.]com/folder/ip/stt.php. Sucuri SiteCheck detected those Magento infections as malware.magento_shoplift?199, indicating a broader campaign affecting multiple e-commerce sites.
Researchers identified a similar obfuscated JavaScript skimmer in the database of a Magento 1.x site. The malware shared the same decoding approach and code structure as the X-Cart variant, but exfiltrated data to winsiott[.]com/folder/ip/stt.php instead of deriving its domain from the DOM.
After brute-forcing the anti-debugging-dependent deobfuscation, analysts recovered the X-Cart skimmer logic and determined it built the exfiltration URL hxxps://metahtmlhead[.]com/folder/ip/zxc.php from the infected page's DOM.
Analysts found a compromised X-Cart e-commerce site containing both a server-side skimmer in payment/payment_swoosh_cc.php and an obfuscated client-side JavaScript skimmer in skin/common_files/check_cc_number_script.tpl. The server-side malware stored base64-encoded payment POST data in a fake .jpg file, while the client-side skimmer collected checkout form data and exfiltrated it after validating a credit card number was present.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Researchers uncovered Magecart-style web skimming campaigns that concealed malicious JavaScript inside image files to evade detection on compromised e-commerce sites. In one case affecting **Magento 2.x** stores, injected code retrieved a seemingly legitimate PNG file at `/pub/media/wysiwyg/m2themes/googletagmanager.png`, extracted data appended after the PNG `IEND` marker, and executed the hidden payload in the browser to steal payment information entered at checkout. A related campaign hid skimmer code in **EXIF metadata** and used image files for data theft, showing attackers were abusing trusted media formats both to stage malware and to exfiltrate stolen credit-card details. Investigators also found the Magento skimmer relied on a booby-trapped GitHub repository, `mag202/magento`, where malicious `mage.png` files were repeatedly uploaded and removed to update payloads and derive exfiltration gates tied to lookalike domains such as `fontsgoogle-apis[.]com` and `googletag-manager[.]com`, underscoring a broader shift toward image-based concealment and legitimate-platform abuse in web skimming operations.
Aug 14, 2026
A large Magecart campaign compromised nearly 100 Magento and Adobe Commerce stores by hiding a full credit-card skimmer inside a **1x1-pixel SVG** embedded directly in checkout page HTML. Researchers said the malware stores its payload in the SVG `onload` handler, decodes it with `atob()`, and runs it via `setTimeout`, allowing it to evade scanners that typically look for externally loaded scripts. When shoppers click checkout, the skimmer displays a convincing fake **"Secure Checkout"** overlay that captures billing and payment details before validating card numbers with the **Luhn algorithm**. The stolen data is exfiltrated as XOR-encrypted, base64-obfuscated JSON to attacker-controlled infrastructure, in some cases disguised as Facebook analytics traffic. Sansec linked the infections to exploitation of the **PolyShell** vulnerability, which affects Magento Open Source and Adobe Commerce stable version 2 deployments and can enable unauthenticated code execution and account takeover. Defenders were urged to hunt for hidden SVG tags and suspicious `onload` code, check for the `_mgx_cv` localStorage key, and block outbound traffic to the identified attacker infrastructure, including domains resolving to **`23.137.249.67`** hosted by IncogNet in the Netherlands.
Jun 29, 2026