Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online Stores

A Magecart campaign dubbed HexMage has compromised more than 40 e-commerce storefronts across at least 15 countries, using Ethereum smart contracts as a resilient delivery mechanism for payment-card skimmers.

The operation blends traditional client-side checkout theft with EtherHiding, allowing attackers to conceal and rotate skimmer infrastructure through Ethereum’s Sepolia testnet.

Because the malicious code is injected into the store itself, every customer who reaches a compromised checkout may be exposed not only visitors arriving through an ad.

The campaign primarily targets WooCommerce sites, although researchers also observed infections involving PrestaShop, Magento and standard WordPress installations.

Confiant analyzed 25 victim storefronts, 20 Sepolia contracts and 20 domains used to host skimming scripts.

Each of those contracts was linked to the same owner wallet, 0x88361C914Bb0942da9a1b7Bb396a7513C1917aee, which deployed at least 144 matching contracts between March and July 2026. By August 23, the wallet had deployed 156 contracts.

HexMage operators initially compromise the merchant’s server and add a lightweight JavaScript loader to checkout pages. The injected code is disguised inside a counterfeit Google Tag Manager block, complete with familiar GTM comments and base64-obfuscated configuration data.

Unlike a legitimate GTM snippet, however, the fraudulent block does not load googletagmanager.com/gtm.js. Instead, it fetches the ethers.js Web3 library from the legitimate jsDelivr CDN.

It sends JSON-RPC requests to 0xrpc.io, a public endpoint for Ethereum’s Sepolia testnet.

The loader invokes a publicly accessible getText() function on an attacker-controlled smart contract.

Rather than delivering the entire skimmer directly, the contract returns a hostname for a disposable payload domain.

The browser then combines that hostname with a hardcoded path and silently loads the final JavaScript skimmer.

This design reduces the attacker’s visible footprint. A compromised checkout does not initially contain a hardcoded malicious domain, making static inspection and conventional IOC-based blocking less effective.

Confiant identified the activity Magecart, while scanning the advertising ecosystem for malvertising. The affected merchants were running legitimate advertisements, but ad-tech telemetry exposed server-side compromises on their checkout pages.

If defenders block a payload host, operators can update the value held in the smart contract or deploy another contract without needing to reinfect the merchant website.

Magecart campaign

EtherHiding is typically associated with malware delivery, including fake browser updates, ClickFix lures and infostealers.

It abuses smart-contract storage as a decentralized dead drop, where browser-based malware can retrieve payloads, configuration data, or command-and-control addresses via read-only blockchain queries.

HexMage applies the same technique to Magecart fraud. The final-stage script overlays or replaces the merchant’s legitimate card-payment fields and captures payment-card numbers, expiry dates, CVVs, cardholder names, billing emails and other checkout data.

It then Base64-encodes and exfiltrates the information before restoring the original payment interface so that the purchase can complete normally.

The skimmer is tailored to individual payment gateways, enabling it to impersonate services such as Stripe, PayPal, ePay, PhonePe, HyperPay and regional payment processors.

Researchers also found that the malware often avoids execution when it detects a logged-in WordPress administrator, reducing the likelihood that a merchant will notice the fraudulent checkout during routine testing.

The contracts function as attacker-controlled text storage, exposing public getText() and owner() methods. While the wallet owner can update the stored value through a signed transaction, anyone can read the content without a wallet or on-chain transaction.

This transparency allowed researchers to pivot from contracts observed in live traffic to a wider set of attacker infrastructure.

Confiant found both plaintext Base64-encoded hostnames and encrypted hostname envelopes in the contracts.

The delivery domains often use themed naming patterns, including dark-fantasy names such as bloodthornkeep, ashenravenfort, nightstalkerwatch and voidwalkerforge.

The campaign also includes a second loader variant that skips blockchain retrieval entirely and decodes a complete skimmer URL from Base64.

That fallback means defenders cannot rely solely on detecting Ethereum JSON-RPC activity or unexpected ethers.js imports.

Security teams should investigate checkout pages that load Web3 libraries, communicate with public blockchain RPC endpoints, or contain GTM-like code that fails to request gtm.js.

They should also review server-side website changes, audit administrator accounts and vulnerable plugins, inspect payment templates for unauthorized JavaScript, and deploy content-security policies that restrict unapproved script and outbound network destinations.

For merchants, HexMage reinforces a key Magecart reality: payment theft occurs in the shopper’s browser, after trust in the legitimate website has already been established.

Blockchain-backed staging makes the infrastructure harder to disrupt, but its public nature also gives defenders an opportunity to enumerate contracts, wallets and associated delivery hosts at scale.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide