“Magecart” Strikes Again: Long-Running Web Skimming Campaign Targets Global Payment Networks

A vast and persistent web-skimming campaign, активe since at least January 2022, targets the checkout pages of online retailers and intercepts payments destined for major networks including American Express, Mastercard, and Discover. The operation, dubbed under the Magecart umbrella, compromises legitimate e‑commerce sites using WooCommerce and Stripe and injects malicious JavaScript that lies dormant until the checkout page.

According to Silent Push Preemptive Cyber Defense Analysts, the malware hides the legitimate Stripe Payment Form and replaces it with a malicious iframe that renders a fake Stripe Payment Form with legitimate‑looking variable names and styling. When shoppers submit, data is encrypted and exfiltrated to a criminal server, after which the malware cleans up, restores the real form, and simulates a click on Place Order, leaving users believing they entered the information incorrectly.

The campaign uses a MutationObserver to monitor pages and a self‑destruct mechanism triggered if the wpadminbar element is defined in the DOM, making detection harder for site operators, supported by “bulletproof” hosting for its command‑and‑control servers.