Skimming on the Blockchain: A Magecart Campaign That Uses EtherHiding, Found by Malvertising Scanning

This campaign represents a sophisticated card-skimming operation targeting e-commerce platforms by combining client-side payment skimming with EtherHiding, a technique that stages malicious payloads inside Ethereum blockchain smart-contract storage. Attackers compromise legitimate online storefronts, primarily WooCommerce, but also PrestaShop, Magento, and WordPress sites, injecting a loader disguised as Google Tag Manager code. The infrastructure includes 144 Sepolia blockchain contracts controlled by one wallet, with 20 distinct contracts and associated skimmer-hosting domains identified in network traffic. The malicious code is hidden server-side to appear as ordinary analytics plumbing while exfiltrating credit card information from unsuspecting shoppers. This approach leverages blockchain storage to evade traditional detection methods and maintain persistence.

The campaign results in theft of credit card information from customers of compromised e-commerce websites. By hiding payloads in Ethereum smart contracts and disguising malicious loaders as legitimate analytics code, attackers evade detection and maintain persistence. This compromises the confidentiality of payment data and can lead to financial fraud and reputational damage for affected merchants. Over 40 websites in 15 countries have been impacted, indicating a broad and ongoing threat.

No specific patch or remediation is provided in the available data. Since this is a compromise of legitimate storefronts via injection of malicious code, affected site operators should conduct thorough code audits and remove injected loaders disguised as Google Tag Manager. Monitoring for unusual blockchain contract interactions related to EtherHiding may help detect this threat. Implementing strong website security practices, including timely updates and integrity checks, is advisable. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.