Sophisticated Magecart Campaign Targets E-Commerce Sites Across 12 Countries for Over Two Years A large-scale Magecart operation has been active since at least early 2024, compromising 17 WooCommerce websites across 12 countries, including the UK, Denmark, France, Spain, and the U.S. Security researchers at ANY.RUN uncovered the campaign, which has persisted undetected for over 24 months, leveraging more than 100 malicious domains to steal payment card data in real time. The attack primarily exploits the Redsys payment ecosystem, with a notable concentration of victims in Spain. While e-commerce merchants serve as the initial entry point, the financial impact disproportionately affects banks and cardholders, as stolen data fuels downstream fraud and erodes trust in digital payments. ### How the Attack Works The campaign employs a multi-stage infection chain designed to evade detection: 1. Initial Compromise – Attackers inject an obfuscated JavaScript loader into a WooCommerce site’s existing scripts. 2. Dynamic Payload Retrieval – The loader fetches a JSON-encoded configuration from external domains, cycling through backup domains if primary ones are blocked. 3. Fake Payment Overlay – The malicious script replaces or overlays legitimate payment forms with convincing fakes, mimicking trusted providers like Redsys and PayPlug SAS in multiple languages (English, Spanish, Arabic, French). 4. Data Exfiltration via WebSockets – Stolen card details (BIN, full number, CVV, expiration) are transmitted via encrypted WebSocket channels, bypassing traditional HTTP-based monitoring. 5. Mobile Attack Vector – On mobile devices, the script prompts users to download malicious Android APKs under the guise of discounts, further expanding the attack surface. ### Key Tactics & Infrastructure - High-Fidelity Impersonation – Domains like jquerybootstrap[.]com and assetsbundle[.]com mimic legitimate services. - Persistent Command & Control – Some C2 servers (e.g., redsysgate[.]com) masquerade as trusted payment domains. - Global Targeting – The campaign’s localized fake payment forms and APK prompts indicate a deliberate, organized effort rather than opportunistic skimming. ### Impact & Defensive Priorities The operation reflects a shift in Magecart tactics from quick, opportunistic attacks to long-term, infrastructure-driven campaigns with real-time control. Financial institutions face increased fraud losses, while security teams must prioritize: - Monitoring WebSocket traffic from checkout pages. - Enforcing strict Content Security Policies (CSP). - Implementing JavaScript file integrity checks. - Conducting regular third-party script audits. The campaign underscores the evolving sophistication of digital skimming threats, with attackers investing in resilient infrastructure to sustain operations despite takedowns.