An active Magecart campaign targeting ecommerce sites has been uncovered, featuring payloads customized per victim with sophisticated evasion techniques. The attack begins with a script injection disguised as a Google Tag Manager loader, which decodes a base64 URL at runtime to inject malicious JavaScript. The skimmer includes
Table of contents
The Magecart ThreatThe initial compromiseTargeted attackSkimmer activationThe CSP BypassOngoing threatWhat defenders should do nowIndicators of CompromiseSort: