# Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration

> A 24-month Magecart campaign leveraging 100+ domains has compromised 17+ WooCommerce sites across Spain, France, and the US. The operation uses multi-stage obfuscated JavaScript loaders, WebSocket-based card data exfiltration, and mimics legitimate payment processors like Redsys to steal PAN, CVV, and BIN data for bank fraud.

- **Published:** 2026-03-30T12:00:00Z
- **Last reviewed:** 2026-09-27T02:36:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0296
- **ID:** TL-2026-0296
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Magecart
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A large-scale, highly sophisticated Magecart campaign has been operating for over 24 months, supported by an infrastructure of more than 100 malicious domains. Between February 2024 and April 2025, at least 17 WooCommerce-based e-commerce websites were confirmed compromised, with victims spanning at least 12 countries including Spain, France, the United States, the United Kingdom, and Denmark.

The attack chain begins with the injection of a small, obfuscated JavaScript loader into the compromised WooCommerce site. This initial loader does not contain the card-stealing logic itself — it functions purely as a delivery mechanism. The loader iterates through a list of backup C2 domains until it receives a valid response, providing significant resilience against domain takedowns. Configuration data is delivered as encoded arrays of numeric character codes, which are decoded in the victim's browser at runtime.

Once the configuration is retrieved, the loader dynamically injects a second-stage payload via DOM manipulation, adding script elements that fetch the main skimmer from rotating payload sources. The skimmer employs advanced anti-analysis techniques including function serialization checks, bitwise and arithmetic operations for anti-tampering verification, custom virtual machine opcodes for code virtualization, and localStorage-based state persistence to maintain its foothold across page navigations.

The skimmer monitors the checkout process and, upon detecting the payment step, either replaces or overlays the legitimate payment interface with a high-fidelity fake. In the Spanish market, the fake payment page mimics Redsys (sis.redsys.es), the dominant payment gateway. PayPlug SAS payment windows have also been observed being imitated. The overlays support multiple languages including English, Spanish, Arabic, and French, indicating a professionally prepared infrastructure rather than ad hoc operations.

Data exfiltration is performed via WebSocket connections (wss://) rather than traditional HTTP POST requests. The WebSocket channel serves multiple purposes: transmitting service events, sending BIN (Bank Identification Number) data, exfiltrating full payment card details (PAN, CVV, expiry), and receiving additional C2 commands. The C2 WebSocket URL is stored obfuscated in localStorage. This choice of exfiltration channel significantly reduces visibility in conventional HTTP logging and monitoring tools, as WebSocket traffic is often not inspected by traditional WAFs and security monitoring solutions.

Additionally, the campaign includes an Android component: the skimmer checks the user's environment and, when mobile users are detected, offers an Android APK installation bundled with discount incentives — extending the fraud surface beyond the web browser.

The campaign's domain infrastructure features names designed to mimic legitimate analytics and CDN services (e.g., analyticsgctm.com mimicking Google Tag Manager, hotjarcdn.com mimicking Hotjar, doubleclickcache.com mimicking Google DoubleClick), making network-level detection more challenging. The domain redsysgate.com directly impersonates the Spanish Redsys payment infrastructure.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1176 Software Extensions
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1185 Browser Session Hijacking
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [ANY.RUN: Global Magecart Campaign Puts Banks Under Pressure](https://any.run/cybersecurity-blog/banks-magecart-campaign/)
- [Malpedia: js.magecart Malware Family Entry](https://malpedia.caad.fkie.fraunhofer.de/details/js.magecart)
- [Malpedia: Campaign Library Entry](https://malpedia.caad.fkie.fraunhofer.de/library/1047d16c-eae0-43d4-a5b8-8687a1b73a61/)
- [Hendry Adrian: Active Magecart Campaign Targets Spain](https://www.hendryadrian.com/active-magecart-campaign-targets-spain-steals-card-data-via-hijacked-estores-for-bank-fraud/)
- [Silent Push: Magecart Network Infrastructure Analysis](https://www.silentpush.com/blog/magecart/)
- [Malwarebytes: Magecart Skimming Hits Major Payment Networks](https://www.malwarebytes.com/blog/news/2026/01/online-shoppers-at-risk-as-magecart-skimming-hits-major-payment-networks)
- [Malware.News: Global Magecart Campaign Puts Banks Under Pressure](https://malware.news/t/global-magecart-campaign-puts-banks-under-pressure-leveraging-redsys-payment-mimicry-and-hijacking/105420)
- [Akamai: Magecart Campaign Abusing Legitimate Websites](https://www.akamai.com/blog/security-research/new-magecart-hides-behind-legit-domains)
- [Santander Security Research: e-Skimming Detection Semgrep Rules](https://github.com/Santandersecurityresearch/e-Skimming-Detection)
- [Trustwave SpiderLabs: State of Magecart](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-of-magecart-a-persistent-threat-to-e-commerce-security/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0296