Loading threat actor…
Magecart is an umbrella term for multiple financially motivated cybercriminal groups that specialize in digital payment-card skimming against e-commerce websites. The ecosystem is commonly associated with compromises of Magento and Adobe Commerce stores, but operations have also targeted WooCommerce, WordPress-based payment plugins, and third-party suppliers embedded in online checkout flows. Rather than a single cohesive actor, Magecart refers to a loose collection of groups and operators that inject malicious client-side or server-side code into payment pages to steal cardholder data and related customer information for resale and fraud. Magecart activity centers on web skimmers implemented in JavaScript or, in some cases, PHP-based server-side implants. Common tradecraft includes injecting fake payment forms, harvesting values from input, select, and textarea elements, capturing billing and contact details alongside payment card data, and exfiltrating stolen information through attacker-controlled infrastructure disguised as legitimate analytics, tag-management, image, or payment-service traffic. Operators frequently abuse trusted services and brands for stealth, including Google Tag Manager, Stripe, GitHub-hosted content, and lookalike domains themed around Google, analytics libraries, content delivery, or payment providers. Some campaigns have used WebSocket-based delivery, browser storage for persistence and deduplication, anti-debugging logic, self-removing scripts, obfuscation layers, hidden payloads appended to image files, and inline SVG-based execution to evade detection. The ecosystem has repeatedly targeted smaller merchants as well as major brands through direct compromise of storefronts and through supply-chain intrusion into third-party script providers. Public reporting has linked Magecart activity to compromises affecting Ticketmaster and numerous other online retailers, with campaigns spanning hundreds of victim sites globally. Researchers and vendors have also described distinct subgroups or clusters, including references such as Magecart Group 7, ATMZOW, and infrastructure-linked campaigns such as Magentocore, underscoring that attribution within Magecart is fragmented and often difficult. Observed capabilities include initial access through vulnerable e-commerce platforms, plugins, and third-party components; persistence via implanted scripts or modified application files; defense evasion through obfuscation and trusted-platform abuse; credential and payment-data theft; and exfiltration of stolen customer information. The dominant motivation is financial gain through theft of payment card data and related personally identifiable information.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
134 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting web skimming attacks against e-commerce checkout pages by abusing trusted services such as Google Tag Manager and Stripe to load payment-card skimmers and exfiltrate stolen customer payment and personal data.
Conducting web skimming attacks against e-commerce checkout pages by abusing trusted services such as Google Tag Manager, Stripe API infrastructure, and in a variant, Google Firestore, to load skimmer code and exfiltrate stolen payment data.
Payment-card skimming activity used in exploitation of the FunnelKit Funnel Builder vulnerability to steal checkout data from WooCommerce stores.
Conducting web skimming/payment card theft by injecting malicious JavaScript into ecommerce checkout pages and disguising it as legitimate analytics or tag manager code.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.