A newly uncovered Magecart attack campaign is targeting e-commerce platforms, using highly obfuscated JavaScript to steal sensitive payment data.
This latest iteration of Magecart skimming demonstrates advanced evasion tactics, enabling the malware to stealthily capture credit card information during the checkout process.
Injected into compromised online stores, the malicious script runs silently in the background, forming a covert channel between unsuspecting users and the attackers’ command-and-control infrastructure.
The operation follows a multi-stage intrusion strategy, beginning with unauthorized access to the site’s back-end systems.
Investigators found that attackers typically begin by compromising administrator credentials, often obtained via infostealer malware deployed on victims’ devices.
With these credentials, the attackers gain privileged access, enabling them to bypass conventional security defenses and establish a foothold within the targeted infrastructure.
Yarix researchers uncovered this specific Magecart variant during a forensic investigation into compromised e-commerce platforms.
Their analysis found that, after obtaining administrative access, the attackers quickly deployed a tailored PHP web shell to ensure persistent access—allowing them to retain control of the server even if the initial intrusion is detected.
The web shell shares structural traits with the open-source P.A.S. Fork v1.4 tool, but features custom modifications unique to this campaign.
Beyond financial theft, these attacks inflict severe reputational harm on affected merchants and undermine consumer trust.
The exfiltrated data often includes full payment card information (card number, expiration date, CVV), along with personal details such as names, addresses, emails, and shipping information—giving attackers everything needed to commit fraud or identity theft.
The attack unfolds in four distinct phases:
- Initial access to the back-end via stolen administrator credentials
- Persistent control through the installation of a custom PHP web shell
- Database poisoning by injecting obfuscated JavaScript code
- Credit card data theft, where customer payment information is captured and exfiltrated
This structured approach highlights the advanced operational methods employed by the threat actors.
Obfuscation and Exfiltration Tactics
The malicious JavaScript code leverages advanced obfuscation techniques to avoid detection. The script is heavily scrambled, appearing as a chaotic mix of hexadecimal strings, complex variable assignments, and nested function calls—all without clear formatting or indentation.
At the core of the obfuscation lies a key function named chameleon, which dynamically redefines itself during execution. This function operates in tandem with immediately invoked function expressions (IIFEs), making reverse engineering particularly difficult.
Here’s an example snippet from the script:
