Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration

Active Magecart Campaign Targets Spain via Hijacked (TL-2026-0296), also tracked as js.magecart, is a high-severity malware campaign, first published 2026-03-30. It is attributed to Magecart with low confidence, affects WooCommerce WooCommerce, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-0296

Threat ID
TL-2026-0296
Also known as
js.magecart, Magecart Spain Campaign, Redsys Magecart
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-03-30
Last reviewed
2026-03-30
Attribution
Magecart
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
e-commerce, retail, financial, banking, payment-processing
Target regions
Spain, France, United States, United Kingdom, Denmark, Europe, North America
Detection rules
9
Indicators of compromise
27

Malware and tooling in Active Magecart Campaign Targets Spain via Hijacked

Malware and tooling: magecart, WebSocket C2 with fallback domain rotation

A 24-month Magecart campaign leveraging 100+ domains has compromised 17+ WooCommerce sites across Spain, France, and the US. The operation uses multi-stage obfuscated JavaScript loaders, WebSocket-based card data exfiltration, and mimics legitimate payment processors like Redsys to steal PAN, CVV, and BIN data for bank fraud.

How Active Magecart Campaign Targets Spain via Hijacked works

A large-scale, highly sophisticated Magecart campaign has been operating for over 24 months, supported by an infrastructure of more than 100 malicious domains. Between February 2024 and April 2025, at least 17 WooCommerce-based e-commerce websites were confirmed compromised, with victims spanning at least 12 countries including Spain, France, the United States, the United Kingdom, and Denmark.

The attack chain begins with the injection of a small, obfuscated JavaScript loader into the compromised WooCommerce site. This initial loader does not contain the card-stealing logic itself — it functions purely as a delivery mechanism. The loader iterates through a list of backup C2 domains until it receives a valid response, providing significant resilience against domain takedowns. Configuration data is delivered as encoded arrays of numeric character codes, which are decoded in the victim's browser at runtime.

Once the configuration is retrieved, the loader dynamically injects a second-stage payload via DOM manipulation, adding script elements that fetch the main skimmer from rotating payload sources. The skimmer employs advanced anti-analysis techniques including function serialization checks, bitwise and arithmetic operations for anti-tampering verification, custom virtual machine opcodes for code virtualization, and localStorage-based state persistence to maintain its foothold across page navigations.

The skimmer monitors the checkout process and, upon detecting the payment step, either replaces or overlays the legitimate payment interface with a high-fidelity fake. In the Spanish market, the fake payment page mimics Redsys (sis.redsys.es), the dominant payment gateway. PayPlug SAS payment windows have also been observed being imitated. The overlays support multiple languages including English, Spanish, Arabic, and French, indicating a professionally prepared infrastructure rather than ad hoc operations.

Data exfiltration is performed via WebSocket connections (wss://) rather than traditional HTTP POST requests. The WebSocket channel serves multiple purposes: transmitting service events, sending BIN (Bank Identification Number) data, exfiltrating full payment card details (PAN, CVV, expiry), and receiving additional C2 commands. The C2 WebSocket URL is stored obfuscated in localStorage. This choice of exfiltration channel significantly reduces visibility in conventional HTTP logging and monitoring tools, as WebSocket traffic is often not inspected by traditional WAFs and security monitoring solutions.

Additionally, the campaign includes an Android component: the skimmer checks the user's environment and, when mobile users are detected, offers an Android APK installation bundled with discount incentives — extending the fraud surface beyond the web browser.

The campaign's domain infrastructure features names designed to mimic legitimate analytics and CDN services (e.g., analyticsgctm.com mimicking Google Tag Manager, hotjarcdn.com mimicking Hotjar, doubleclickcache.com mimicking Google DoubleClick), making network-level detection more challenging. The domain redsysgate.com directly impersonates the Spanish Redsys payment infrastructure.

MITRE ATT&CK techniques used in TL-2026-0296

collection

T1005 Data from Local System; T1056 Input Capture; T1185 Browser Session Hijacking

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port

persistence

T1176 Software Extensions; T1505 Server Software Component

initial-access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

resource-development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities

impact

T1657 Financial Theft

Affected products and versions in Active Magecart Campaign Targets Spain via Hijacked

  • WooCommerce — WooCommerce
    Vulnerable versions: All versions (plugin/theme-level injection)
  • WordPress — WordPress
    Vulnerable versions: All versions running WooCommerce
  • Redsys — Redsys Payment Gateway (mimicked)
    Vulnerable versions: N/A - legitimate service mimicked by attacker
  • PayPlug — PayPlug SAS Payment (mimicked)
    Vulnerable versions: N/A - legitimate service mimicked by attacker

Remediation for Active Magecart Campaign Targets Spain via Hijacked

Patches

  • Keep WooCommerce and all plugins updated to latest versions
  • Apply all WordPress core security patches
  • Remove any unauthorized WordPress admin accounts or plugins

Immediate actions

  • Audit all WooCommerce checkout pages for unauthorized JavaScript inclusions
  • Block all 16 known C2 domains at network perimeter (bundle-feedback.com, doubleclickcache.com, analyticsgctm.com, hotjarcdn.com, firefoxcaptcha.com, solutionjquery.com, jquerybootstrap.com, assetsbundle.com, bundle-referrer.com, categorywishlist.com, cachesecure.com, securedata-ns.com, analysiscache.com, newassetspro.com, explorerpros.com, redsysgate.com)
  • Monitor WebSocket (wss://) connections from checkout pages to unknown endpoints
  • Review localStorage for obfuscated C2 URLs on e-commerce platforms
  • Scan for unauthorized script injections in WooCommerce wp_enqueue_scripts hooks

Workarounds

  • Use server-side payment processing that redirects to payment gateway (no client-side card entry)
  • Implement tokenized payment via Redsys/Stripe hosted fields to avoid card data touching merchant page
  • Enable two-factor authentication for all WooCommerce admin accounts

Longer-term hardening

  • Implement Content Security Policy (CSP) headers restricting script sources on checkout pages
  • Deploy Subresource Integrity (SRI) for all legitimate third-party scripts
  • Implement real-time JavaScript change monitoring on payment pages
  • Enable WebSocket traffic inspection in WAF and security monitoring tools
  • Conduct regular integrity checks of WooCommerce plugin files and database entries

Weaknesses (CWE) in Active Magecart Campaign Targets Spain via Hijacked

CWE-79, CWE-94, CWE-506

Timeline of Active Magecart Campaign Targets Spain via Hijacked

  • Earliest confirmed WooCommerce site infection linked to this Magecart campaign
  • Campaign infrastructure expands beyond initial domains; multiple fallback C2 domains registered mimicking legitimate analytics services
  • Redsys payment gateway mimicry first observed targeting Spanish e-commerce sites with high-fidelity fake payment overlays
  • WebSocket-based exfiltration channel (wss://) confirmed as primary data exfiltration method replacing traditional HTTP POST exfil
  • 17 WooCommerce websites confirmed infected across Spain, France, US, UK, Denmark and 7+ additional countries
  • Advanced anti-analysis techniques detected including custom VM opcodes, function serialization checks, and localStorage state persistence
  • Campaign infrastructure reaches 100+ registered domains providing multi-layer fallback resilience against takedowns
  • Silent Push publishes infrastructure analysis uncovering new Magecart network of domains associated with ongoing web-skimmer campaigns
  • Malwarebytes reports Magecart skimming hitting major payment networks including AmEx, Diners Club, and Mastercard
  • Malpedia creates library entry for this campaign variant under js.magecart family
  • ANY.RUN researchers khr0x and raptur3 publish comprehensive technical analysis of the campaign, detailing multi-stage loader architecture, WebSocket exfiltration, and Redsys mimicry
  • Threat documented and published to Threadlinqs Intelligence Platform as TL-2026-0296
  • As of 2026-05-29, this Magecart WooCommerce/Redsys skimming campaign remains active: the latest reporting (Silent Push Jan, Malwarebytes Jan, ANY.RUN Mar 2026) describes it as ongoing with no takedown or sinkhole. Its 100+ fallback domains, bulletproof hosting and WebSocket exfil are built for takedown resilience, and the CVE-less web-skimming technique stays fully viable.

Sources cited for Active Magecart Campaign Targets Spain via Hijacked

Threats related to Active Magecart Campaign Targets Spain via Hijacked

Detection coverage for TL-2026-0296

As of 2026-03-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0296 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats