# HexMage Magecart Campaign Uses Ethereum Smart Contracts for Resilient Card-Skimmer C2

> A Magecart-style payment card skimming campaign dubbed 'HexMage', tracked by Confiant, has compromised 40+ e-commerce storefronts across 15+ countries since March/April 2026 by injecting a fake Google Tag Manager loader that queries Ethereum Sepolia testnet smart contracts via public RPC to fetch disposable delivery domains for the skimmer payload ('EtherHiding').

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2251
- **ID:** TL-2026-2251
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

HexMage is a Magecart-class card-skimming campaign identified by Confiant via malvertising/website scanning and publicly disclosed in late August 2026. Attackers compromise WooCommerce, PrestaShop, Magento, and standard WordPress storefronts and inject a JavaScript loader disguised as a counterfeit Google Tag Manager block (real `<!-- Google Tag Manager -->` comment markers, a `dataLayer.push({'gtm.start': ...})` call, and a fake `GoogleTagManagerLoaderScript` global) that never actually fetches `googletagmanager.com/gtm.js`.

The loader pulls the ethers.js Web3 library from jsDelivr and performs a read-only `eth_call` (getter selector `0xe00fe2eb`, i.e. `getText()`) against an attacker-deployed Ethereum Sepolia testnet 'TextStorage' smart contract to retrieve a disposable delivery hostname, which is combined with a hardcoded path to fetch the final skimming script. Because reading contract storage via a public RPC (`0xrpc.io/sep`) requires no wallet, signature, or transaction, the C2 lookup leaves no on-chain trace and is effectively unblockable/uncensorable at the domain-registrar level -- a pattern Confiant and other researchers term 'EtherHiding.' Confiant linked 144 (growing to 156 by August 23, 2026) Sepolia smart contracts, deployed between March 28 and August 2026, to a single owner wallet (`0x88361C914Bb0942da9a1b7Bb396a7513C1917aee`) sharing identical runtime bytecode. Storage format evolved over the campaign: plaintext Base64-encoded domains (pre-April 29, 2026, 'style'-themed domain names) gave way to an encrypted salt:IV:ciphertext envelope (PBKDF2-SHA256/100,000 iterations + AES-256-GCM, post-May 19, 2026, 'dark fantasy'-themed domain names). Only 15 `setText()` (owner-only setter, selector `0x5d3a1f9d`) calls were observed across 144 contracts in four months, indicating the contracts are largely provisioned once rather than actively rotated.

The delivered payload is a heavily obfuscated (obfuscator.io string-array encoding plus host-keyed multi-layer XOR, decoded and injected via `Blob`/`URL.createObjectURL` to avoid static string exposure) Magecart skimmer. It is config-driven and gateway-aware, shipping fake form overlays and CSS that impersonate Stripe, PayPal, ePay (Denmark), Yaad (Israel), Transbank (Chile), and WooCommerce/PrestaShop native checkout fields (18+ confirmed gateway-specific selectors). Captured fields include card number, expiry, CVV, cardholder name, and billing email; data is Luhn-validated (with test-card blacklisting) and Base64-encoded before exfiltration over configurable transports (fetch/GET, `navigator.sendBeacon`, WebSocket, or 1x1 image pixel) to the same disposable delivery domains or, in some cases, back through the victim's own compromised domain. The skimmer checks for a logged-in WordPress admin bar and silently aborts if detected, delaying merchant-side discovery -- one storefront (elisacavaletti.it) remained compromised and unremediated across at least April-July 2026. Confiant also found two 'blockchain-free' variant samples that hardcode the final skimmer URL directly in a Base64 blob, skipping the Ethereum/ethers.js step entirely -- evidence the operators can fall back off-chain when convenient.

HexMage is one of several 2026 campaigns applying the broader 'EtherHiding' dead-drop-resolver pattern (previously documented using BNB Smart Chain by other researchers, including a distinct BSC/WebSocket-based Magecart variant profiled by Trinity Cyber) to abuse public blockchain read access as free, resilient, takedown-resistant malware/C2 staging infrastructure.

## MITRE ATT&CK

- T1583.001 Domains
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1056.003 Web Portal Capture
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [Hackers Use Ethereum Blockchain to Deliver Payment Card Skimmer](https://cybersecuritynews.com/hackers-use-ethereum-blockchain/)
- [Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning](https://blog.confiant.com/p/skimming-on-the-blockchain-a-magecart)
- [Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online Stores](https://gbhackers.com/magecart-campaign-3/)
- [Hackers Turn Ethereum Blockchain Into a Card-Skimming Network Targeting Online Shoppers](https://cyberpress.org/ethereum-card-skimming-network/)
- [Researchers Uncover Magecart Attack Leveraging Blockchain Infrastructure](https://securityboulevard.com/2026/07/researchers-uncover-magecart-attack-leveraging-blockchain-infrastructure/)
- [Lost in the Ether: Unravelling a JavaScript Card Skimming Campaign](https://www.trinitycyber.com/blog/lost-in-the-ether-unravelling-a-javascript-card-skimming-campaign)
- [Potential EtherHiding C2 via Blockchain Connection (prebuilt detection rule)](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/macos/command_and_control_potential_etherhiding_c2)
- [EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons](https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons)
- [EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution](https://www.picussecurity.com/resource/blog/etherhiding-how-web3-infrastructure-enables-stealthy-malware-distribution)
- [Cribl SecOps uncovers EtherHiding malware campaign on the blockchain](https://cribl.io/blog/cribl-secops-uncovers-etherhiding-malware-campaign-on-the-blockchain/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2251