Magecart

Magecart is a form of malware, malicious software designed to exploit and damage computer systems. It typically infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside a system, Magecart can steal personal information, disrupt operations, or hold data for ransom. The first identified instance of a Magecart injection was discovered as obfuscated JavaScript on compromised checkout pages, raising suspicions due to its unusual placement beneath several empty lines in the page's source code. In 2023, Magecart actors continued to utilize Google Tag Manager, Telegram Messenger, and attack-carrier domains to propagate e-skimmer infections. These platforms were used to distribute the malware and compromise more systems, expanding the reach of the Magecart campaign. The use of these popular platforms allowed the malicious actors to hide their activities among legitimate traffic, making detection more challenging. A new campaign involving Magecart was recently detected, where the malicious code was hidden in default 404 error pages. This innovative approach allows the malware to remain undetected, as 404 error pages are commonly encountered during regular internet use and are not typically scrutinized for malicious activity. By exploiting this blind spot, the Magecart campaign has been able to further its reach and continue its harmful activities.