Ethereum Blockchain Used to Steal Credit Card Data From Shoppers

Key Takeaways

• A new Magecart campaign, dubbed HexMage, is actively stealing credit card data from online shoppers.
• The attackers compromise e-commerce websites and inject malicious checkout code.
• HexMage uniquely leverages the Ethereum blockchain’s Sepolia testnet to host and retrieve its skimmer delivery infrastructure, making it highly resilient to traditional blocking methods.
• Over 40 merchant websites across at least 15 countries have been affected since April 2026, including those running WooCommerce, PrestaShop, Magento, and standard WordPress.
• Shoppers are impacted even on legitimate sites, as the attack occurs server-side during the checkout process, making it difficult to detect.

Online shoppers face a growing threat from sophisticated Magecart attacks that compromise legitimate e-commerce sites to steal payment card details. A recently identified campaign, dubbed HexMage, has innovated its approach by integrating Ethereum blockchain infrastructure to maintain its malicious delivery system, making it more persistent and evasive.

The HexMage campaign has been observed compromising more than 40 merchant websites across at least 15 countries since approximately April 2026. This extensive reach highlights the significant risk posed to both online retailers and their customers.

The attackers have targeted a range of popular e-commerce platforms, including WooCommerce, PrestaShop, Magento, and standard WordPress sites. This broad targeting indicates a versatile and opportunistic approach, putting a wide array of businesses and their patrons at risk of financial data theft.

Security researchers at Confiant first uncovered this activity by monitoring advertisements served by the affected merchants. Confiant said in a report that their analysis traced 20 Sepolia contracts back to a single owner wallet, which had deployed 144 contracts between March and July. This extensive deployment suggests a well-resourced and organized threat actor.

Unlike traditional phishing schemes that trick users into downloading malware, HexMage directly compromises the server-side infrastructure of trusted checkout pages. This means that regardless of how a shopper accesses the site—be it through an advertisement, search engine result, saved bookmark, or direct link—they are vulnerable to having their payment information intercepted during a seemingly routine transaction.

Hackers Use Ethereum Blockchain for Resilience

The core of the HexMage operation involves implanting a small JavaScript loader disguised within a fake Google Tag Manager block on compromised storefronts. This malicious code mimics legitimate analytics scripts but does not load the genuine Google Tag Manager. This tactic leverages a known camouflage technique, making casual code reviews less effective in detecting the intrusion.

When a shopper initiates the checkout process, this hidden loader retrieves the ethers.js library from a content delivery network. It then queries a smart contract hosted on Ethereum’s Sepolia testnet via a public Remote Procedure Call (RPC) service. This smart contract provides a dynamically generated, disposable delivery domain name. The loader then combines this domain with a predefined path to download the final credit card skimmer payload.

This innovative technique, termed EtherHiding, allows attackers to use a public blockchain as a dynamic directory for their command-and-control infrastructure. By not hardcoding every address directly into the malicious script, the operators can easily update or replace delivery domains without needing to modify the loader script on each infected website. While similar blockchain-based recovery mechanisms have been observed in other Ethereum blockchain malware operations, HexMage uniquely applies this resilience to web payment skimming.

This architecture poses a significant challenge for traditional blocking methods. However, security researchers can leverage the public nature of blockchain data to their advantage. By querying public contract data, investigators can trace shared ownership, identify related contracts, and potentially uncover malicious infrastructure before it is actively used in live attacks.

Fake Forms Hide the Theft

Once downloaded, the skimmer code remains dormant until the user selects a credit card payment option. At this point, it superimposes a highly convincing, fake payment form over the legitimate one. This deceptive overlay is designed to capture sensitive financial details, including the card number, expiration date, CVV, cardholder name, billing email, and other checkout information. The collected data is then exfiltrated in a Base64-encoded format.

After successfully collecting the data, the skimmer seamlessly restores the original payment page, allowing the legitimate transaction to complete without the shopper’s immediate knowledge. A particularly insidious aspect of this campaign is its ability to evade detection by site administrators: the malicious form is intentionally not displayed to logged-in WordPress administrators, allowing the infection to persist unnoticed for extended periods.

This stealthy approach mirrors other recent skimming tactics, such as the SVG checkout skimmer campaign, which also employed fake payment overlays to deceive victims.

The researchers also identified several delivery variants, including one that bypassed the blockchain entirely, embedding the complete skimmer URL directly within encoded page code. This finding underscores that defenders should not solely focus on blockchain traffic. Any suspicious fake tag blocks, unexplained requests for ethers.js, or unexpected scripts during checkout should be investigated as potential indicators of compromise.

What You Should Do

For E-commerce Merchants:

• Conduct Regular Security Audits: Thoroughly examine server-side changes, installed plugins, and administrator accounts for any unauthorized modifications or suspicious activity.
• Monitor Checkout Scripts: Carefully review every tag and script loaded during the checkout process. Pay close attention to unexpected requests to unfamiliar domains or any unusual script behavior.
• Test as a Guest User: Periodically test your checkout process while logged out to observe the customer experience and identify any anomalies that might be hidden from logged-in administrators.
• Implement Content Security Policy (CSP): A strict CSP can help mitigate Magecart attacks by restricting which resources (like scripts) can be loaded by your website.
• Rotate Credentials: If an intrusion is suspected, immediately remove any unauthorized code, rotate all administrative and database credentials, and review affected transactions.
• Stay Informed: Keep abreast of the latest Magecart attack vectors, including those leveraging novel techniques like blockchain infrastructure. Lessons from incidents such as the <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/c477ccd4-7006-4e88-b34d-1d0a18ece2b4/Hackers-Use-Ethereum-Blockchain-to-Steal-Credit-Card-Data-From-Online-Shoppers.pdf?AWSAccessKeyId=ASIA2F3EMEYE3C466P2U&Signature=q9iqk1ammpJPGsQCApQv8Uq0Mo%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMr%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIFvCrk5y2mgdiDJKTRhsVFvrZDzgZVvTqOhylltBjgL%2BAiBho%2F%2FvnJfTHrB1OS71uIuVz2hxHIsxXjTetP0zOUAc0yr8BAiT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAEaDDY5OTc1MzMwOTcwNSIMndJrezPsi0cDTNXrKtAEe4RSAObfos%2FJu8t6dc0sWZt2%2FwjBayS%2FHYk9

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackHackerMalwareSecurityThreat