HexMage Magecart Campaign Uses Ethereum Smart Contracts for Resilient Card-Skimmer C2

HexMage Magecart Campaign Uses Ethereum Smart Contracts for (TL-2026-2251), also tracked as HexMage, is a high-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Automattic/WooThemes WooCommerce, maps to 10 MITRE ATT&CK techniques (T1027, T1056.003, T1059.007), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2251

Threat ID
TL-2026-2251
Also known as
HexMage, EtherHiding Magecart Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-31
Last reviewed
2026-08-31
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
ecommerce, retail, marine electronics, fashion, food and beverage, medical, technology retail, financial services
Target regions
denmark, italy, croatia, israel, united kingdom, chile, bangladesh, india, greece, romania, france, spain
Detection rules
9
Indicators of compromise
24

Malware and tooling in HexMage Magecart Campaign Uses Ethereum Smart Contracts for

Malware and tooling: HexMage

A Magecart-style payment card skimming campaign dubbed 'HexMage', tracked by Confiant, has compromised 40+ e-commerce storefronts across 15+ countries since March/April 2026 by injecting a fake Google Tag Manager loader that queries Ethereum Sepolia testnet smart contracts via public RPC to fetch disposable delivery domains for the skimmer payload ('EtherHiding').

How HexMage Magecart Campaign Uses Ethereum Smart Contracts for works

HexMage is a Magecart-class card-skimming campaign identified by Confiant via malvertising/website scanning and publicly disclosed in late August 2026. Attackers compromise WooCommerce, PrestaShop, Magento, and standard WordPress storefronts and inject a JavaScript loader disguised as a counterfeit Google Tag Manager block (real `<!-- Google Tag Manager -->` comment markers, a `dataLayer.push({'gtm.start': ...})` call, and a fake `GoogleTagManagerLoaderScript` global) that never actually fetches `googletagmanager.com/gtm.js`.

The loader pulls the ethers.js Web3 library from jsDelivr and performs a read-only `eth_call` (getter selector `0xe00fe2eb`, i.e. `getText()`) against an attacker-deployed Ethereum Sepolia testnet 'TextStorage' smart contract to retrieve a disposable delivery hostname, which is combined with a hardcoded path to fetch the final skimming script. Because reading contract storage via a public RPC (`0xrpc.io/sep`) requires no wallet, signature, or transaction, the C2 lookup leaves no on-chain trace and is effectively unblockable/uncensorable at the domain-registrar level -- a pattern Confiant and other researchers term 'EtherHiding.' Confiant linked 144 (growing to 156 by August 23, 2026) Sepolia smart contracts, deployed between March 28 and August 2026, to a single owner wallet (`0x88361C914Bb0942da9a1b7Bb396a7513C1917aee`) sharing identical runtime bytecode. Storage format evolved over the campaign: plaintext Base64-encoded domains (pre-April 29, 2026, 'style'-themed domain names) gave way to an encrypted salt:IV:ciphertext envelope (PBKDF2-SHA256/100,000 iterations + AES-256-GCM, post-May 19, 2026, 'dark fantasy'-themed domain names). Only 15 `setText()` (owner-only setter, selector `0x5d3a1f9d`) calls were observed across 144 contracts in four months, indicating the contracts are largely provisioned once rather than actively rotated.

The delivered payload is a heavily obfuscated (obfuscator.io string-array encoding plus host-keyed multi-layer XOR, decoded and injected via `Blob`/`URL.createObjectURL` to avoid static string exposure) Magecart skimmer. It is config-driven and gateway-aware, shipping fake form overlays and CSS that impersonate Stripe, PayPal, ePay (Denmark), Yaad (Israel), Transbank (Chile), and WooCommerce/PrestaShop native checkout fields (18+ confirmed gateway-specific selectors). Captured fields include card number, expiry, CVV, cardholder name, and billing email; data is Luhn-validated (with test-card blacklisting) and Base64-encoded before exfiltration over configurable transports (fetch/GET, `navigator.sendBeacon`, WebSocket, or 1x1 image pixel) to the same disposable delivery domains or, in some cases, back through the victim's own compromised domain. The skimmer checks for a logged-in WordPress admin bar and silently aborts if detected, delaying merchant-side discovery -- one storefront (elisacavaletti.it) remained compromised and unremediated across at least April-July 2026. Confiant also found two 'blockchain-free' variant samples that hardcode the final skimmer URL directly in a Base64 blob, skipping the Ethereum/ethers.js step entirely -- evidence the operators can fall back off-chain when convenient.

HexMage is one of several 2026 campaigns applying the broader 'EtherHiding' dead-drop-resolver pattern (previously documented using BNB Smart Chain by other researchers, including a distinct BSC/WebSocket-based Magecart variant profiled by Trinity Cyber) to abuse public blockchain read access as free, resilient, takedown-resistant malware/C2 staging infrastructure.

MITRE ATT&CK techniques used in TL-2026-2251

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Credential Access

T1056.003 Web Portal Capture

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1583.001 Domains

Affected products and versions in HexMage Magecart Campaign Uses Ethereum Smart Contracts for

  • Automattic/WooThemes — WooCommerce
    Vulnerable versions: N/A - not a software vulnerability; primary targeted platform for storefront compromise and skimmer injection regardless of version
  • PrestaShop SA — PrestaShop
    Vulnerable versions: N/A - not a software vulnerability; secondary targeted platform for storefront compromise and skimmer injection regardless of version
  • Adobe — Magento
    Vulnerable versions: N/A - not a software vulnerability; secondary targeted platform for storefront compromise and skimmer injection regardless of version
  • WordPress Foundation — WordPress (standard installations)
    Vulnerable versions: N/A - not a software vulnerability; secondary targeted platform for storefront compromise and skimmer injection regardless of version

Remediation for HexMage Magecart Campaign Uses Ethereum Smart Contracts for

Patches

  • No vendor patch applies directly -- HexMage is a post-compromise implant on legitimate e-commerce platforms, not a software vulnerability; remediation requires closing whatever initial-access vector (vulnerable plugin, stolen admin credentials, etc.) allowed the injection

Immediate actions

  • Audit checkout/cart page source for injected '<!-- Google Tag Manager -->' comment blocks that do not actually load googletagmanager.com/gtm.js -- HexMage's loader fakes the GTM wrapper without the real script tag
  • Block/monitor outbound requests from storefront visitor sessions to known HexMage delivery domains (e.g., bloodboundcitadel.top, styletimeset.com) at web/DNS proxy or WAF
  • Flag or block unexpected in-browser calls to public blockchain RPC endpoints (e.g., 0xrpc.io) from e-commerce checkout pages, since legitimate storefront JS has no reason to perform eth_call/eth_chainId requests
  • Rotate CMS admin credentials, API keys, and plugin/theme editor access on affected WooCommerce, PrestaShop, Magento, and WordPress storefronts, and check for unauthorized theme/plugin file or database-stored script modifications
  • Engage the payment processor / acquiring bank for a PCI Forensic Investigation and card-brand compromise notification on any storefront confirmed to have served the skimmer

Workarounds

  • Temporarily disable/quarantine any Google Tag Manager-style script block pending manual verification that it loads the genuine googletagmanager.com/gtm.js
  • Force checkout-page script loading to a pinned, reviewed allow-list until a full compromise assessment is complete

Longer-term hardening

  • Deploy a strict Content Security Policy (script-src allow-list) on checkout pages and explicitly restrict or monitor 'blob:' script execution, which HexMage uses to inject decoded payloads without a static <script src> footprint
  • Adopt hosted-iframe/tokenized payment fields (e.g., Stripe Elements, PayPal hosted fields) so raw card data never touches storefront-controlled DOM and cannot be scraped by a page-level skimmer
  • Establish a recurring third-party/analytics script inventory and integrity-monitoring process (e.g., page-integrity or supply-chain security tooling) for all scripts loaded on checkout flows
  • Patch and harden the underlying CMS/plugin stack (WooCommerce, PrestaShop, Magento, WordPress) since the campaign relies on an initial storefront compromise before injecting the loader

Weaknesses (CWE) in HexMage Magecart Campaign Uses Ethereum Smart Contracts for

CWE-829, CWE-494

Timeline of HexMage Magecart Campaign Uses Ethereum Smart Contracts for

  • Attacker wallet 0x88361C914Bb0942da9a1b7Bb396a7513C1917aee deploys the first HexMage 'TextStorage' smart contracts on the Ethereum Sepolia testnet, per Confiant's on-chain analysis.
  • HexMage skimmer injections begin appearing on compromised WooCommerce, PrestaShop, Magento, and WordPress storefronts, per Confiant's reported 'April 2026 onward' activity window.
  • Last observed use of the early plaintext-Base64 domain-storage format and 'style'-themed delivery domain naming (e.g., styletimeset.com) in HexMage contracts before the operators change encoding schemes.
  • HexMage contracts begin storing delivery domains as a salt:IV:ciphertext envelope (PBKDF2-SHA256, 100,000 iterations, plus AES-256-GCM), coinciding with a shift to 'dark fantasy'-themed domain naming (e.g., bloodboundcitadel.top).
  • Confiant documents a live skimmer capture against Danish storefront marinexperten.dk (ePay gateway), one of 25 compromised storefronts analyzed in depth.
  • The attacker wallet's cumulative smart-contract deployment count reaches 144 since the March 28, 2026 start of provisioning.
  • The attacker wallet's cumulative smart-contract deployment count reaches 156, showing continued active provisioning of C2 infrastructure through late August 2026.
  • One HexMage smart contract's stored delivery-domain value is rewritten via setText(); all other observed contracts remain stable, indicating operators rarely rotate already-provisioned contracts.
  • Cyber Security News, GBHackers, and other outlets publicly report on the HexMage campaign following Confiant's research blog post 'Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding.'

Sources cited for HexMage Magecart Campaign Uses Ethereum Smart Contracts for

More in malware

Detection coverage for TL-2026-2251

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2251 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats