New Magecart Attack Injects Malicious JavaScript to Steal Payment Data

A new Magecart-style campaign has emerged that leverages malicious JavaScript injections to skim payment data from online checkout forms.

The threat surfaced after security researcher sdcyberresearch posted a cryptic tweet hinting at an active campaign hosted on cc-analytics[.]com.

Subsequent analysis revealed a heavily obfuscated script that hooks into checkout fields, collects credit card and billing information, and exfiltrates stolen data to an attacker-controlled domain.

At its core, the code defines an _0x1B3A1 function that decodes hex-encoded strings via repeated regex replaces and a custom base conversion routine, before immediately evaluating them with eval().

Analysts quickly unraveled the obfuscation by prepending debugger; in browser developer tools and by printing the original payload string in Python. Automated deobfuscation services like Obf-IO further simplified the process, revealing clear JavaScript logic.

After cleanup, the script consists of two main components: a data collection function that listens for changes on payment form elements (checkout__input) and clicks on credit-card selection buttons, and a data exfiltration function named sendStolenData().

When a user enters a card number longer than 14 digits, the skimmer packages the cardNumber and billingInfo fields into a FormData object and sends them via POST to https://www.pstatics.com/i.

This simple yet effective approach mirrors classic Magecart tactics, but the injection mechanism and domain naming patterns have evolved.

Infrastructure and Pivoting

Pivoting from the initial cc-analytics[.]com domain revealed a broader infrastructure footprint. URLScan.io searches for cc-analytics.com uncovered dozens of compromised e-commerce sites containing