Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration
Active Magecart Campaign Targets Spain via Hijacked (TL-2026-0296), also tracked as js.magecart, is a high-severity malware campaign, first published 2026-03-30. It is attributed to Magecart with low confidence, affects WooCommerce WooCommerce, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0296
- Threat ID
- TL-2026-0296
- Also known as
- js.magecart, Magecart Spain Campaign, Redsys Magecart
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-03-30
- Last reviewed
- 2026-03-30
- Attribution
- Magecart
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- e-commerce, retail, financial, banking, payment-processing
- Target regions
- Spain, France, United States, United Kingdom, Denmark, Europe, North America
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Active Magecart Campaign Targets Spain via Hijacked
Malware and tooling: magecart, WebSocket C2 with fallback domain rotation
A 24-month Magecart campaign leveraging 100+ domains has compromised 17+ WooCommerce sites across Spain, France, and the US. The operation uses multi-stage obfuscated JavaScript loaders, WebSocket-based card data exfiltration, and mimics legitimate payment processors like Redsys to steal PAN, CVV, and BIN data for bank fraud.
How Active Magecart Campaign Targets Spain via Hijacked works
A large-scale, highly sophisticated Magecart campaign has been operating for over 24 months, supported by an infrastructure of more than 100 malicious domains. Between February 2024 and April 2025, at least 17 WooCommerce-based e-commerce websites were confirmed compromised, with victims spanning at least 12 countries including Spain, France, the United States, the United Kingdom, and Denmark.
The attack chain begins with the injection of a small, obfuscated JavaScript loader into the compromised WooCommerce site. This initial loader does not contain the card-stealing logic itself — it functions purely as a delivery mechanism. The loader iterates through a list of backup C2 domains until it receives a valid response, providing significant resilience against domain takedowns. Configuration data is delivered as encoded arrays of numeric character codes, which are decoded in the victim's browser at runtime.
Once the configuration is retrieved, the loader dynamically injects a second-stage payload via DOM manipulation, adding script elements that fetch the main skimmer from rotating payload sources. The skimmer employs advanced anti-analysis techniques including function serialization checks, bitwise and arithmetic operations for anti-tampering verification, custom virtual machine opcodes for code virtualization, and localStorage-based state persistence to maintain its foothold across page navigations.
The skimmer monitors the checkout process and, upon detecting the payment step, either replaces or overlays the legitimate payment interface with a high-fidelity fake. In the Spanish market, the fake payment page mimics Redsys (sis.redsys.es), the dominant payment gateway. PayPlug SAS payment windows have also been observed being imitated. The overlays support multiple languages including English, Spanish, Arabic, and French, indicating a professionally prepared infrastructure rather than ad hoc operations.
Data exfiltration is performed via WebSocket connections (wss://) rather than traditional HTTP POST requests. The WebSocket channel serves multiple purposes: transmitting service events, sending BIN (Bank Identification Number) data, exfiltrating full payment card details (PAN, CVV, expiry), and receiving additional C2 commands. The C2 WebSocket URL is stored obfuscated in localStorage. This choice of exfiltration channel significantly reduces visibility in conventional HTTP logging and monitoring tools, as WebSocket traffic is often not inspected by traditional WAFs and security monitoring solutions.
Additionally, the campaign includes an Android component: the skimmer checks the user's environment and, when mobile users are detected, offers an Android APK installation bundled with discount incentives — extending the fraud surface beyond the web browser.
The campaign's domain infrastructure features names designed to mimic legitimate analytics and CDN services (e.g., analyticsgctm.com mimicking Google Tag Manager, hotjarcdn.com mimicking Hotjar, doubleclickcache.com mimicking Google DoubleClick), making network-level detection more challenging. The domain redsysgate.com directly impersonates the Spanish Redsys payment infrastructure.
MITRE ATT&CK techniques used in TL-2026-0296
collection
T1005 Data from Local System; T1056 Input Capture; T1185 Browser Session Hijacking
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port
persistence
T1176 Software Extensions; T1505 Server Software Component
initial-access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
resource-development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
impact
Affected products and versions in Active Magecart Campaign Targets Spain via Hijacked
- WooCommerce — WooCommerce
Vulnerable versions: All versions (plugin/theme-level injection) - WordPress — WordPress
Vulnerable versions: All versions running WooCommerce - Redsys — Redsys Payment Gateway (mimicked)
Vulnerable versions: N/A - legitimate service mimicked by attacker - PayPlug — PayPlug SAS Payment (mimicked)
Vulnerable versions: N/A - legitimate service mimicked by attacker
Remediation for Active Magecart Campaign Targets Spain via Hijacked
Patches
- Keep WooCommerce and all plugins updated to latest versions
- Apply all WordPress core security patches
- Remove any unauthorized WordPress admin accounts or plugins
Immediate actions
- Audit all WooCommerce checkout pages for unauthorized JavaScript inclusions
- Block all 16 known C2 domains at network perimeter (bundle-feedback.com, doubleclickcache.com, analyticsgctm.com, hotjarcdn.com, firefoxcaptcha.com, solutionjquery.com, jquerybootstrap.com, assetsbundle.com, bundle-referrer.com, categorywishlist.com, cachesecure.com, securedata-ns.com, analysiscache.com, newassetspro.com, explorerpros.com, redsysgate.com)
- Monitor WebSocket (wss://) connections from checkout pages to unknown endpoints
- Review localStorage for obfuscated C2 URLs on e-commerce platforms
- Scan for unauthorized script injections in WooCommerce wp_enqueue_scripts hooks
Workarounds
- Use server-side payment processing that redirects to payment gateway (no client-side card entry)
- Implement tokenized payment via Redsys/Stripe hosted fields to avoid card data touching merchant page
- Enable two-factor authentication for all WooCommerce admin accounts
Longer-term hardening
- Implement Content Security Policy (CSP) headers restricting script sources on checkout pages
- Deploy Subresource Integrity (SRI) for all legitimate third-party scripts
- Implement real-time JavaScript change monitoring on payment pages
- Enable WebSocket traffic inspection in WAF and security monitoring tools
- Conduct regular integrity checks of WooCommerce plugin files and database entries
Weaknesses (CWE) in Active Magecart Campaign Targets Spain via Hijacked
CWE-79, CWE-94, CWE-506
Timeline of Active Magecart Campaign Targets Spain via Hijacked
- Earliest confirmed WooCommerce site infection linked to this Magecart campaign
- Campaign infrastructure expands beyond initial domains; multiple fallback C2 domains registered mimicking legitimate analytics services
- Redsys payment gateway mimicry first observed targeting Spanish e-commerce sites with high-fidelity fake payment overlays
- WebSocket-based exfiltration channel (wss://) confirmed as primary data exfiltration method replacing traditional HTTP POST exfil
- 17 WooCommerce websites confirmed infected across Spain, France, US, UK, Denmark and 7+ additional countries
- Advanced anti-analysis techniques detected including custom VM opcodes, function serialization checks, and localStorage state persistence
- Campaign infrastructure reaches 100+ registered domains providing multi-layer fallback resilience against takedowns
- Silent Push publishes infrastructure analysis uncovering new Magecart network of domains associated with ongoing web-skimmer campaigns
- Malwarebytes reports Magecart skimming hitting major payment networks including AmEx, Diners Club, and Mastercard
- Malpedia creates library entry for this campaign variant under js.magecart family
- ANY.RUN researchers khr0x and raptur3 publish comprehensive technical analysis of the campaign, detailing multi-stage loader architecture, WebSocket exfiltration, and Redsys mimicry
- Threat documented and published to Threadlinqs Intelligence Platform as TL-2026-0296
- As of 2026-05-29, this Magecart WooCommerce/Redsys skimming campaign remains active: the latest reporting (Silent Push Jan, Malwarebytes Jan, ANY.RUN Mar 2026) describes it as ongoing with no takedown or sinkhole. Its 100+ fallback domains, bulletproof hosting and WebSocket exfil are built for takedown resilience, and the CVE-less web-skimming technique stays fully viable.
Sources cited for Active Magecart Campaign Targets Spain via Hijacked
- ANY.RUN: Global Magecart Campaign Puts Banks Under Pressure
- Malpedia: js.magecart Malware Family Entry
- Malpedia: Campaign Library Entry
- Hendry Adrian: Active Magecart Campaign Targets Spain
- Silent Push: Magecart Network Infrastructure Analysis
- Malwarebytes: Magecart Skimming Hits Major Payment Networks
- Malware.News: Global Magecart Campaign Puts Banks Under Pressure
- Akamai: Magecart Campaign Abusing Legitimate Websites
- Santander Security Research: e-Skimming Detection Semgrep Rules
- Trustwave SpiderLabs: State of Magecart
Threats related to Active Magecart Campaign Targets Spain via Hijacked
Detection coverage for TL-2026-0296
As of 2026-03-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0296 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.