Hackers Use Ethereum Blockchain to Steal Credit Card Data From Online Shoppers

Online shoppers can have their card details stolen without ever leaving a legitimate store. A tracked Magecart campaign plants malicious checkout code on compromised e-commerce sites, then uses Ethereum blockchain infrastructure to keep its delivery system active.

The campaign, dubbed HexMage, has affected more than 40 merchant websites in at least 15 countries since about April 2026.

The attackers targeted WooCommerce stores as well as PrestaShop, Magento, and standard WordPress sites, putting merchants and shoppers at risk.

Analysts at Confiant identified the activity through scanning advertisements run by the compromised merchants.

Confiant said in a report shared with Cyber Security News (CSN) that it linked 20 observed Sepolia contracts to one owner wallet that had deployed 144 contracts between March and July.

Rather than luring victims into installing software, the operation strikes at the point where shoppers trust a checkout page.

Its server-side compromise means a visitor can be exposed whether they arrive through an ad, search result, saved bookmark, or direct link, turning a routine purchase into theft.

Hackers Use Ethereum Blockchain

The attackers hide a small JavaScript loader inside a fake Google Tag Manager block on an infected store. It resembles ordinary analytics code, but does not fetch the genuine Google Tag Manager script.

That camouflage echoes earlier Google Tag Manager payment theft cases, while making a quick review of page code less reliable.

When the checkout opens, the loader retrieves ethers.js from a content delivery network and queries a smart contract on Ethereum’s Sepolia testnet through a public RPC service.

The contract returns a disposable delivery-domain name, which the loader combines with a pre-set path to download the final skimmer.

This is EtherHiding: attackers use a public blockchain as a directory for attack infrastructure instead of placing every address directly in the code.

Similar blockchain-based recovery mechanisms have appeared in Ethereum blockchain malware operations, but HexMage applies the approach to web payment theft.

The structure frustrates simple blocking. Operators can replace a domain stored in a contract without modifying the loader left on an infected site.

Investigators, however, can also query public contract data to trace shared ownership, find related contracts and identify infrastructure before live use.

Fake Forms Hide the Theft

The downloaded code waits until the shopper chooses a card-payment option, then places a convincing form over the real payment area.

It can collect the card number, expiry date, CVV, cardholder name, billing email, and other checkout details, then sends the information out in Base64-encoded form.

After collecting data, the skimmer restores the normal page so the legitimate purchase can finish. It avoids showing the malicious form to logged-in WordPress administrators, which can leave store owners unaware of an infection for months.

The tactic resembles a recent SVG checkout skimmer campaign that also used a fake payment overlay to keep victims from noticing.

The researchers found several delivery variants, including one that skips the blockchain and contains a complete skimmer URL inside encoded page code.

That means defenders should not rely only on blockchain traffic: a suspicious fake tag block, an unexplained ethers.js request, or unexpected checkout scripts can each reveal the intrusion.

Store operators should examine server-side changes, plugins, administrator accounts, and every tag or script loaded during checkout.

They should also compare checkout behavior while signed out, inspect requests to unfamiliar domains, and remove unauthorized code before rotating credentials and reviewing affected transactions.

Lessons from a Stripe API skimmer incident underline why trusted web services and payment pages still need close monitoring.

For shoppers, a successful order is not proof that a checkout was safe. Anyone who used a card at a merchant later confirmed as compromised should contact their card issuer promptly, watch for unfamiliar charges, and replace the card if advised.

The campaign shows how familiar online stores can become effective collection points when attackers hide behind resilient blockchain infrastructure.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use Ethereum Blockchain to Steal Credit Card Data From Online Shoppers appeared first on Cyber Security News.