Magecart Hack Injects JavaScript to Steal Online Payment Data

Cybersecurity: Magecart-Style Campaign Targets E-commerce Websites

A recent Magecart-style campaign has been identified, targeting e-commerce websites by injecting malicious JavaScript to intercept and exfiltrate payment card data during the checkout process.

The malicious script, hosted at cc-analytics[.]com/app.js, was detected on compromised sites through script injection. The code uses obfuscation techniques, including hex encoding and base conversion functions, to evade detection.

Security researchers deobfuscated the payload using debugger methods and Python string analysis, uncovering its intent to harvest sensitive payment information. The decompiled code employs event listeners on checkout input fields and payment method buttons to collect data. When users enter credit card numbers or billing information, the script transmits these details to attacker-controlled servers at pstatics[.]com via XMLHttpRequest POST requests.

Data exfiltration only occurs when card numbers exceed 14 characters, indicating basic validation measures to avoid capturing incomplete or test data.

Further investigation using URLScan revealed a broader attack infrastructure. The malicious script appeared on multiple compromised websites, injected via <script src="https://www.cc-analytics.com/app.js"></script> tags in the DOM.

By analyzing transaction logs, researchers identified the hosting IP address as 45.61.136.141. This led to the discovery of additional malicious domains with similar naming patterns, such as jgetjs.com, getnjs.com, getvjs.com, getejs.com, and utilanalytics.com. Analysis of JavaScript payloads across these domains showed nearly identical code, suggesting infrastructure reuse across multiple attack campaigns.

An expanded domain portfolio potentially linked to this campaign was uncovered, including domains masquerading as legitimate services and nameserver patterns across multiple suspicious domains. Researchers emphasize the importance of validation before implementing blocking rules, as some domains may be false positives or sinkholed.

The attack underscores the effectiveness of simple reconnaissance techniques. Tools like URLScan, publicWWW, and WHOIS queries were sufficient to map attacker infrastructure and identify patterns.

Organizations can detect similar injections by monitoring for unexpected script tags in checkout pages, analyzing network requests during payment processing, and searching public data sources for mentions of their domain names. This Magecart variant highlights the ongoing profitability of payment data theft for cybercriminals.

The campaign's longevity and infrastructure reuse suggest operational sustainability. E-commerce security practices such as content security policies, script integrity verification, and payment form isolation are crucial. Defenders should focus on identifying injected scripts on checkout pages, monitoring for suspicious POST requests to external domains, and implementing subresource integrity checks.

The investigation illustrates how public signals, when properly correlated, can reveal entire attack campaigns, emphasizing that threat hunting remains accessible with basic security tools and analytical discipline.

Based on reporting by GBHackers.