Loading threat actor…
Magecart 12 is a financially motivated web-skimming threat cluster associated with payment-card theft from compromised e-commerce websites. The actor is part of the broader Magecart ecosystem and has been observed running sustained client-side skimmer campaigns against online shops, using externally hosted JavaScript loaders and obfuscated second-stage payloads to capture checkout data and exfiltrate stolen information. Observed Magecart 12 activity includes repeated compromises of online retail sites across multiple campaigns in 2019 and 2020. The group used skimmer infrastructure that changed over time while preserving consistent tradecraft, including staged payload delivery, heavy obfuscation with garbage code, and integrity or tamper checks in some variants. One documented evolution of the skimmer expanded collection from form-focused harvesting to broader collection of all fields present on a page, increasing the likelihood of capturing payment and other customer data entered during checkout. The actor’s operations show overlap across campaigns through related skimmer infrastructure and near-identical payloads, suggesting operational continuity rather than isolated incidents. In addition to externally loaded skimmers, Magecart 12 has also been observed placing the full skimmer directly inline on compromised sites. Its targeting is centered on e-commerce victims, particularly smaller and mid-sized online merchants, with the objective of stealing payment-card data from customers at the point of purchase. High-confidence reporting links infrastructure used in one campaign predominantly to Russia-based hosting or resolution, but this supports infrastructure geography rather than definitive state sponsorship. No high-confidence evidence establishes Magecart 12 as a nation-state actor. Known alias usage in the supplied material is limited to Magecart 12.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting ongoing web-skimming campaigns against e-commerce sites to steal payment card data via injected credit card skimmers and exfiltration infrastructure.
A Magecart subgroup attributed with credit card skimming attacks against e-commerce websites, using externally hosted JavaScript skimmers and obfuscated loader/second-stage code to steal payment card data from compromised online stores.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.