Magecart

Profile narrative

Magecart, also tracked as Magecart Group or Group 148, is a threat actor whose known location is Russia. The group is recognized for compromising websites and injecting malicious JavaScript that skims payment card information during online checkout processes. Their activity has been observed across a variety of sectors, including retail (e‑cigarette stores, jewelry and accessories chains, clothing retailers, photography shops, and firearms manufacturers), municipal payment portals, ticket‑reselling platforms, and cloud‑based software development kits. Magecart frequently abuses legitimate third‑party services or libraries—such as the Slippry content slider, ZenDesk‑look‑alike domains, or misconfigured Amazon S3 buckets hosting SDKs—to load obfuscated skimmer scripts from attacker‑controlled domains. The skimmers capture form fields (name, address, phone, email, card number, expiration date, CVV) and exfiltrate the data via HTTP POST requests, image URLs, WebSocket connections, or Telegram bots, often employing evasion techniques like dynamic loading, keyword‑based triggers, and minimal obfuscation to avoid detection.

Representative incidents illustrate the group’s tradecraft. In early 2022 a prominent e‑cigarette retailer was compromised by a heavily obfuscated script hosted externally and linked to a Telegram bot that harvested card data after the site had been verified clean. Later that year Emma Matratzen GmbH suffered a sophisticated Magecart injection that dynamically loaded code from an external server and used advanced evasion to bypass security controls, affecting roughly ninety‑seven thousand customers across twelve countries. In mid‑2020 Twilio disclosed that a misconfigured S3 bucket allowed attackers to inject malicious code into version 1.20 of its TaskRouter JS SDK, which then redirected users to a domain associated with Magecart and the Hookads malvertising campaign. The same period saw Claire’s jewelry chain compromised through a spoofed domain (claires‑assets.com) that received skimmed data from a modified app.min.js file on Salesforce servers. A series of U.S. municipal websites using Click2Gov payment software were hit with a simple skimmer that hooked the submit button and sent data to two hard‑coded servers, with five of the eight cities previously breached via the same software. A ticket reseller for major sporting events hid the skimmer inside a legitimate Slippry library, activating on payment‑related keywords and remaining undetected for up to fifty days on one site. Smith & Wesson’s online store received a conditional script that served a fake payment form to U.S.‑based, non‑Linux visitors not on AWS, sending data to live.sequracdn[.]net. These examples demonstrate the group’s reliance on web‑based skimming, third‑party abuse, and varied exfiltration methods to obtain payment card data.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 14 sources.