Magecart

Magecart is a form of malware that targets e-commerce platforms by injecting malicious code to steal customer data. The malware can infect systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can disrupt operations and steal personal information. Magecart attacks have been on the rise, with a 103% increase in the first half of 2024 alone. These attacks are expected to continue posing a significant threat, as attackers keep experimenting with new e-skimming techniques. In a recent campaign, Magecart actors ingeniously hid their malicious code within 404 error pages, an unconventional method that made detection more challenging. This tactic demonstrates the increasing sophistication of Magecart campaigns. In addition to this, Magecart actors continued to use Google Tag Manager, Telegram Messenger, and attack-carrier domains for e-skimmer infections throughout 2023. The first identified MageCart injection was a standard obfuscated JavaScript, commonly seen on compromised checkout pages. However, further investigation revealed additional malicious items buried beneath several empty lines in the source view. This discovery underscores the stealthy and evolving tactics used by Magecart actors, reinforcing the need for robust cybersecurity measures, especially for e-commerce platforms.