In a sophisticated cyberattack, hackers have utilized the Ethereum blockchain to illicitly obtain credit card information from online shoppers. The method, part of a Magecart campaign identified as HexMage, involves injecting malicious code into the checkout process of compromised e-commerce platforms, leveraging blockchain technology for persistence.
Global Impact of HexMage Campaign
Since April 2026, HexMage has targeted over 40 online merchants across at least 15 countries. The campaign predominantly affects sites using WooCommerce, PrestaShop, Magento, and WordPress, posing significant risks to both merchants and consumers. Analysts from Confiant uncovered the scheme through an analysis of ads originating from affected stores.
Confiant’s report, shared with Cyber Security News, reveals a connection between 20 Sepolia contracts and a singular Ethereum wallet, responsible for deploying numerous contracts between March and July. This highlights a strategic focus on exploiting trusted checkout environments rather than relying on traditional software-based lures.
Technical Details of the Attack
The attackers skillfully disguise a JavaScript loader within a counterfeit Google Tag Manager block, enabling it to blend in with legitimate analytics scripts. Upon checkout initiation, this loader retrieves additional scripts from a content delivery network and communicates with a smart contract on Ethereum’s Sepolia testnet. The contract then supplies a domain for the final skimmer delivery.
This approach, termed EtherHiding, signifies a novel use of public blockchain as a directory for attack infrastructure, complicating detection and prevention efforts. The attackers can seamlessly update the domain used without altering the compromised site’s code, thereby evading simple blocking mechanisms.
Mitigation and Consumer Safety
To mitigate such threats, e-commerce operators are urged to scrutinize server-side modifications, check plugins and admin accounts, and inspect all scripts loaded during the checkout process. Comparing checkout behaviors while logged out and monitoring requests to unfamiliar domains are also recommended practices.
Consumers, on the other hand, should remain vigilant. Successful transactions do not guarantee checkout safety. Those who suspect their card information may have been compromised should immediately contact their card issuer, watch for unauthorized charges, and replace their card if necessary.
The HexMage campaign underscores the vulnerability of online stores and the sophisticated measures attackers employ by using resilient blockchain technology as a cover. Continuous monitoring and proactive security measures are essential for protecting e-commerce platforms and their users.
