Magecart Campaign Used Staged Loaders and WebSockets to Steal Payment Card Data
Summary
ANY.RUN describes a Magecart campaign active for 24+ months, associating 17 WooCommerce sites with infrastructure spanning 100+ domains. Its analysis details checkout mimicry and staged JavaScript; observed WebSocket exfiltration sent card data, while some site links to
Key points
- ANY.RUN reports the campaign was active for at least 24 months and used more than 100 domains, with 17 WooCommerce sites associated with it from February 2024 to April 2025.
- An injected JavaScript loader fetched configuration and later payload stages from fallback domains, allowing operators to rotate delivery infrastructure.
- The payload monitored checkout pages, replaced or overlaid payment interfaces, and imitated providers including Redsys and PayPlug.
- In an analyzed case, WebSocket traffic was used to exfiltrate payment-card data and receive commands; the article says other cases were linked through infrastructure correlation.
- The JavaScript used obfuscation, anti-tampering checks, custom VM opcodes, and localStorage state persistence.
- The same payload could display a localized prompt to install an Android APK under certain conditions.
Article Details
- Attack Vectors
- Injected, obfuscated JavaScript loaders on compromised e-commerce sites fetched additional payloads from fallback domains.
- The payload replaced or overlaid checkout payment interfaces with fake forms and buttons mimicking providers such as Redsys and PayPlug.
- Fake payment forms captured card details, which the payload transmitted through WebSocket connections to attacker infrastructure.
- The same injected payload could present visitors with an offer to download an Android APK.
- Defensive Notes
- Monitor for unauthorized changes to embedded JavaScript and checkout pages, including replacement or concealment of legitimate payment controls.
- Inspect outbound WebSocket connections and unexpected requests to external staging and payload-delivery domains.
- Use continuous threat monitoring and deep visibility to detect dynamically delivered payloads and changes to payment flows.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | analysiscache[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | analyticsgctm[.]com | Listed as malicious campaign infrastructure. |
| DOMAIN | assetsbundle[.]com | Identified as a domain used to deliver the malicious payload. |
| DOMAIN | bundle-feedback[.]com | Listed as malicious campaign infrastructure used for delivery. |
| DOMAIN | bundle-referrer[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | bundlefeedback[.]com | Identified as a domain used to deliver the malicious payload. |
| DOMAIN | cachesecure[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | categorywishlist[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | doubleclickcache[.]com | Listed as malicious campaign infrastructure. |
| DOMAIN | explorerpros[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | firefoxcaptcha[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | hotjarcdn[.]com | Listed as malicious campaign infrastructure. |
| DOMAIN | jquerybootstrap[.]com | Identified as a domain used to deliver the malicious payload. |
| DOMAIN | newassetspro[.]com | Identified as a domain used to deliver the malicious payload. |
| DOMAIN | redsysgate[.]com | C2 server disguised as a Redsys domain and used for WebSocket card-data exfiltration. |
| DOMAIN | securedata-ns[.]com | Listed in the campaign's indicators of compromise as malicious infrastructure. |
| DOMAIN | solutionjquery[.]com | Listed as malicious campaign infrastructure. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript loader and payload use heavy obfuscation, encoded strings, and a custom VM to hinder analysis.T1036.005 · Match Legitimate Resource Name or LocationCampaign domains and payment interfaces are disguised to resemble legitimate web services and payment providers, including Redsys.T1041 · Exfiltration Over C2 ChannelThe campaign sends captured payment-card data to attacker infrastructure over a WebSocket channel.T1056.003 · Web Portal CaptureA fake payment interface captures card details entered by users on hijacked checkout pages.T1059.007 · JavaScriptThe injected JavaScript loader and payload execute in the victim's browser.T1105 · Ingress Tool TransferThe loader retrieves staging configuration and dynamically downloads subsequent JavaScript payloads from external infrastructure.
Threat Actors
Products
PayPlugPayment step substitution and high-fidelity payment page mimicry (including Redsys and PayPlug-like interfaces) were used to trick users into submitting card data.REDSYSThe attackers used high-fidelity payment page mimicry (notably Redsys) and checkout hijacking to embed fraud into legitimate transaction flows, shifting the primary impact onto banks and payment systems.WooCommerceThe campaign remained active for 24+ months and was supported by over 100 domains, with 17 WooCommerce sites confirmed infected between February 2024 and April 2025.
Countries
DenmarkAmong the victims are organizations from at least 12 countries, including the United Kingdom and Denmark.FranceHowever, there’s a notable concentration of such incidents in Spain, France, and United States.SpainHowever, there’s a notable concentration of such incidents in Spain, France, and United States.United KingdomAmong the victims are organizations from at least 12 countries, including the United Kingdom and Denmark.United StatesHowever, there’s a notable concentration of such incidents in Spain, France, and United States.