Magecart

THREAT ACTOR PROFILE

Magecart

Magecart is the umbrella name for a set of financially motivated groups that steal payment-card data by injecting malicious JavaScript into e-commerce checkout pages. The skimmers capture card details before server-side encryption and exfiltrate them to attacker infrastructure, hitting everyone from small Magento stores to major brands like British Airways and Ticketmaster.

Country:

Not attributed

Financial / eCrime

First seen

2015

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

The Magecart web-skimming collective

Magecart is tracked as an umbrella for multiple web-skimming crews rather than a single group. It maps to one entry among the web-skimming actors we track, and its compromised-site, JavaScript-injection model overlaps with operations like SocGholish.

GROUP PROFILE

JavaScript skimmers on checkout pages

Magecart activity is defined by technique rather than a single actor: compromise a site or its supply chain, inject a skimmer into the checkout flow, and quietly harvest card data as shoppers pay.

Our record ties it to web-skimming operations across e-commerce. Campaigns have abused Google Tag Manager, SVG payloads, fake payment overlays and compromised plugins, with some operators rotating infrastructure through blockchain-based techniques like EtherHiding.

The groups reach victims through supply-chain compromises of plugins, analytics, tag managers and CMS admin panels, then exfiltrate card data over POST requests or WebSockets to attacker domains.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Site compromise into card exfiltration

The stages below come from Magecart activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

JavaScript skimmers and delivery tricks

Initial Access

CVES EXPLOITED

Site and supply-chain compromise, not a fixed CVE set

Magecart groups typically gain access through compromised credentials, vulnerable or outdated e-commerce plugins and supply-chain compromise rather than a single consistent CVE, so this profile does not list a confirmed exploited-CVE set. Detection should focus on unexpected JavaScript on checkout pages, suspicious tag-manager or SVG content, and exfiltration to unfamiliar domains.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Tag Manager skimmers and blockchain-hidden C2

Recent reporting tracks the collective's skimming campaigns.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through