New Magecart Attack Injects Malicious JavaScript to Steal Payment Data

A new Magecart-style campaign has emerged that uses malicious JavaScript injections to skim payment data from online checkout forms, with the exploit described as surfacing after a cryptic hint from a security researcher about an active campaign hosted on cc-analytics[.]com.

Analysis reveals an obfuscated payload that, once decoded, includes a data-collection function that listens for changes on checkout__input and clicks on credit-card selection buttons, and a data-exfiltration function named sendStolenData() that posts cardNumber and billingInfo to https://www.pstatics[.]com/i when a card number longer than 14 digits is entered.

The campaign’s infrastructure has pivoted from cc-analytics[.]com to a broader footprint, with URLScan and related research identifying dozens of compromised sites referencing a script src="https://www.cc-analytics[.]com/app.js" and a shared hosting IP 45.61.136[.]141 linked to a bulletproof provider, along with multiple domains such as cc-analytics[.]com variants, jgetjs[.]com, getnjs[.]com, getvjs[.]com, getejs[.]com and utilanalytics[.]com.

The article notes that attackers reuse similar naming patterns across campaigns, suggesting a single threat actor, and emphasises that these domains have been active for at least a year, complicating takedown efforts. Detection guidance includes watching for unauthorized script tags referencing patterns like “analytics[.]com” or “getjs[.]com,” employing CSP and RASP, and regularly scanning assets and logs while leveraging threat intelligence feeds to automate alerts. The piece also underscises the value of threat hunting and collaboration to map attacker infrastructure and reduce exposure windows.