Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration — Threadlinqs Intelligence
As of 2026-05-30, Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration is a high-severity malware threat attributed to Magecart (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0296 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Magecart · N/A · FINANCIAL
A 24-month Magecart campaign leveraging 100+ domains has compromised 17+ WooCommerce sites across Spain, France, and the US. The operation uses multi-stage obfuscated JavaScript loaders,
A large-scale, highly sophisticated Magecart campaign has been operating for over 24 months, supported by an infrastructure of more than 100 malicious domains. Between February 2024 and April 2025, at least 17 WooCommerce-based e-commerce websites were confirmed compromised, with victims spanning at least 12 countries including Spain, France, the United States, the United Kingdom, and Denmark.
The attack chain begins with the injection of a small, obfuscated JavaScript loader into the compromised WooCommerce site. This initial loader does not contain the card-stealing logic itself — it functions purely as a delivery mechanism. The loader iterates through a list of backup C2 domains until it receives a valid response, providing significant resilience against domain takedowns. Configuration data is delivered as encoded arrays of numeric character codes, which are decoded in the victim's browser at runtime.
Once the configuration is retrieved, the loader dynamically injects a second-stage payload via DOM manipulation, adding script elements that fetch the main skimmer from rotating payload sources. The skimmer employs advanced anti-analysis techniques including function serialization checks, bitwise and arithmetic operations for anti-tampering verification, custom virtual machine opcodes for code virtualization, and localStorage-based state persistence to maintain its foothold across page navigations.
The skimmer monitors the checkout process and, upon detecting the payment step, either replaces or overlays the legitimate payment interface with a high-fidelity fake. In the Spanish market, the fake payment page mimics Redsys (sis.redsys.es), the dominant payment gateway. PayPlug SAS payment windows have also been observed being imitated. The overlays support multiple languages including English, Spanish, Arabic, and French, indicating a professionally prepared infrastructure rather than ad hoc operations.
Data exfiltration is performed via WebSocket connections (wss://) rather than traditional HTTP POST requests. The WebSocket channel serves multiple purposes: transmitting service events, sending BIN (Bank Identification Number) data, exfiltrating full payment card details (PAN, CVV, expiry), and receiving additional C2 commands. The C2 WebSocket URL is stored obfuscated in localStorage. This choice of exfiltration channel significantly reduces visibility in conventional HTTP logging and monitoring tools, as WebSocket traffic is often not inspected by traditional WAFs and security monitoring solutions.
Additionally, the campaign includes an Android component: the skimmer checks the user's environment and, when mobile users are detected, offers an Android APK installation bundled with discount incentives — extending the fraud surface beyond the web browser.
The campaign's domain infrastructure features names designed to mimic legitimate analytics and CDN services (e.g., analyticsgctm.com mimicking Google Tag Manager, hotjarcdn.com mimicking Hotjar, doubleclickcache.com mimicking Google DoubleClick), making network-level detection more challenging. The domain redsysgate.com directly impersonates the Spanish Redsys payment infrastructure.
Weaknesses (CWE)
CWE-79, CWE-94, CWE-506
Target sectors: e-commerce, retail, financial, banking, payment-processing
Target regions: Spain, France, United States, United Kingdom, Denmark, Europe, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1588, T1190, T1195, T1059, T1204, T1176, T1505, T1027