Loading story…
Researchers linked a broader Magecart 12 web-skimming operation to the domain jquerycdn.su, identifying dozens of compromised online stores where malicious JavaScript was injected to steal shoppers’ payment data. The campaign was observed from at least late 2019 into early 2020, and investigators said many affected sites were still infected even after the skimmer infrastructure temporarily went offline. Any payment information entered on impacted checkout pages during the exposure window was assessed as potentially compromised.
Analysis of the malware showed the skimmer evolved through at least four iterations while keeping a consistent obfuscation style associated with earlier Magecart 12 activity. Earlier variants used a first-stage payload padded with garbage code, while newer versions expanded collection beyond standard payment forms to harvest all fields on a page, increasing the amount of customer data that could be captured. Researchers also tied the exfiltration infrastructure to other Magecart 12 campaigns, indicating a sustained and adaptable card-theft operation targeting e-commerce platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The author said they contacted all but three of the affected web shops by email or web form to warn them about the compromise.
The latest newly observed infection associated with the MageCart 12 jquerycdn.su campaign was identified on Kitchen And Couch, showing the operation was still adding victims in February 2020.
A follow-up investigation documented MageCart 12 payment-card skimming activity using the domain toplevelstatic.com, with infections observed across multiple e-commerce sites. The skimmer closely matched a previously seen opendoorcdn.com variant, and the earliest cited victim activity in this cluster began in late January 2020.
The earliest recorded infections tied to the MageCart 12 skimmer domain jquerycdn.su were observed on multiple online shops, marking the start of the documented web-skimming campaign.
As of 2020-02-25, several online shops were still serving the malicious code reference even though jquerycdn.su was offline, meaning payment data entered during infected periods should be treated as compromised.
By the time of writing, the skimmer-hosting domain jquerycdn.su had been down for several days, temporarily interrupting active card theft from some still-infected sites.
The jquerycdn.su campaign expanded across additional e-commerce sites over the following months, with the skimmer changing four times while maintaining the same general obfuscation approach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
riskiq.com
Open sourcemaxkersten.nl
Open sourcemaxkersten.nl
Open sourcemarcoramilli.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Researchers found a compromised **X-Cart** e-commerce site running two separate payment skimmers: a basic server-side stealer and a more advanced client-side JavaScript skimmer. The server-side malware captured base64-encoded payment `POST` data and saved it to a fake `.jpg` file, while the browser-based skimmer validated that a credit card number was present before exfiltrating checkout data to attacker infrastructure. Analysts traced the X-Cart exfiltration path to `metahtmlhead[.]com/folder/ip/zxc.php`, with the destination assembled through DOM-based domain construction to hinder detection. The JavaScript skimmer used layered obfuscation and an anti-debugging technique tied to wrapper-function length, forcing researchers to brute-force parts of the code to recover its behavior. A similar skimmer was later identified on a **Magento 1.x** site, using the same obfuscation style and a matching URL path structure but sending stolen payment data to `winsiott[.]com/folder/ip/stt.php`. The overlap in code design, evasion methods, and infrastructure indicates a broader web-skimming campaign targeting multiple e-commerce platforms.
Aug 15, 2026
A large Magecart campaign compromised nearly 100 Magento and Adobe Commerce stores by hiding a full credit-card skimmer inside a **1x1-pixel SVG** embedded directly in checkout page HTML. Researchers said the malware stores its payload in the SVG `onload` handler, decodes it with `atob()`, and runs it via `setTimeout`, allowing it to evade scanners that typically look for externally loaded scripts. When shoppers click checkout, the skimmer displays a convincing fake **"Secure Checkout"** overlay that captures billing and payment details before validating card numbers with the **Luhn algorithm**. The stolen data is exfiltrated as XOR-encrypted, base64-obfuscated JSON to attacker-controlled infrastructure, in some cases disguised as Facebook analytics traffic. Sansec linked the infections to exploitation of the **PolyShell** vulnerability, which affects Magento Open Source and Adobe Commerce stable version 2 deployments and can enable unauthenticated code execution and account takeover. Defenders were urged to hunt for hidden SVG tags and suspicious `onload` code, check for the `_mgx_cv` localStorage key, and block outbound traffic to the identified attacker infrastructure, including domains resolving to **`23.137.249.67`** hosted by IncogNet in the Netherlands.
Jun 29, 2026