ThreatRoundup

Magecart (web skimming groups)

Umbrella name for the many criminal crews that plant card-skimming JavaScript on store checkouts, from the 2018 British Airways hack to Brazil's Convertr attack.

Threat actor profile · Updated

Active
2015 to October 2026
Origin
Multiple (an umbrella term, not one actor); the group in ThreatRoundup's 2026 coverage is Brazilian, per Sansec
Type
Cybercrime
Affiliates
RiskIQ/Flashpoint Magecart Groups 1 to 7 (2018); GetBilling (Indonesia, per Group-IB); CosmicSting-era groups Sansec names Bobry, Polyovki, Surki, Burunduki, Ondatry, Khomyaki and Belki; unnamed Brazilian group tracked by Sansec since 2024
Regions targeted
Worldwide; Brazil, United Kingdom, United States, Indonesia, Australia, Europe, South America

Profile

Magecart is not one group. It’s an umbrella name for the many criminal crews that plant card-stealing JavaScript, known as web skimmers, on online store checkout pages. The name, per Sansec, blends “Magento” and “shopping cart”. In 2018 RiskIQ and Flashpoint’s joint report Inside Magecart already counted at least seven separate groups using the technique, each with its own skimmer code, infrastructure and way of cashing out. Researchers and the press still say “Magecart” for any group doing this, so a “Magecart attack” in one story and another may have nothing in common beyond the method. This profile covers the technique and the best-documented crews under the label, including the Brazilian group in ThreatRoundup’s own coverage.

The motive is money. A skimmer copies whatever the shopper types into the payment form (card number, expiry, CVV, name, address, sometimes national ID numbers) and sends it to a server the attackers control, from where the card data is sold or used. Victims are mostly mid-sized online stores, but the label became famous in 2018 with big brands: British Airways, where about 380,000 customers’ card details were taken and the UK Information Commissioner’s Office later fined the airline £20 million, and Ticketmaster, where skimming code rode in on a third-party chatbot on the payment page.

Initial access comes in three main flavors. The first is exploiting the store software itself, T1190 (Exploit Public-Facing Application), usually Magento and Adobe Commerce: Sansec counted about 2,800 Magento 1 stores skimmed in a single September 2020 campaign after the platform reached end of life, and at least seven skimming groups racing to use the TrojanOrder and CosmicSting bugs in 2022 and 2024. The second is the supply chain, T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain): compromise a script that many stores load (a chatbot, an analytics tag, a platform-wide tracker) and every checkout that loads it is skimmed at once. The third is stolen or weak admin credentials, which leave no exploit to patch.

The skimmers themselves, T1059.007 (Command and Scripting Interpreter: JavaScript), have become harder to spot. Microsoft described skimmers hidden inside image files and disguised as Google Analytics and Meta Pixel code, and some are injected server-side where browser protections can’t see them. Many fire only on checkout pages, and crews fight over the same stores: Malwarebytes found two rival skimmers on Umbro Brasil in 2018, one quietly corrupting the card numbers the other stole.

Arrests are rare. The best-known case is Operation Night Fury, in which Indonesian police, supported by INTERPOL and Group-IB, arrested three people in late 2019 who Group-IB says ran the GetBilling skimmer family.

Brazil has its own active crews. Sansec has tracked one Brazilian group since July 2024 skimming Magento, OpenCart and WooCommerce stores almost entirely in Brazil, recognizable by Portuguese-named endpoints, short .is domains and skimmers built for Brazilian payment methods. In October 2026 that group made its first supply-chain move: it planted a skimmer in the self-hosted Plausible analytics tracker that every store on the Convertr e-commerce platform loads, reaching dozens of fashion brands’ checkouts for three days. Sansec suspects, but couldn’t confirm, that the attackers got in through CVE-2026-8467 in the outdated Plausible install.

Events

Date Target Narrative Source Our coverage
2026-10-24 to 2026-10-27 Brazilian fashion brands on the Convertr e-commerce platform A Brazilian group adds an obfuscated skimmer to Convertr’s self-hosted Plausible analytics tracker, stealing card data and CPF taxpayer numbers from checkout.convertr pages. Suspected entry: CVE-2026-8467 in Plausible CE 3.0 (unconfirmed). Convertr removed the code on Oct. 27. Sansec Our story
2024-07 to 2026-10 Magento, OpenCart and WooCommerce stores, almost all in Brazil Sansec tracks a Brazilian group with consistent fingerprints: pipe-delimited stolen-data records, Portuguese-named endpoints and short .is exfiltration domains. Sansec
2024-06 to 2024-10 Adobe Commerce and Magento stores worldwide, including big-brand shops About 4,275 stores hacked through CosmicSting (CVE-2024-34102), 5% of the install base, by seven competing groups Sansec names. One group had used TrojanOrder to hijack more than 4,000 stores in 2022. Sansec
2022-11 Magento 2 and Adobe Commerce stores At least seven Magecart groups attempt TrojanOrder attacks (CVE-2022-24086), probing an estimated 38% of stores; cheap exploit kits sold on forums drive the wave. Sansec
2020-09 About 2,800 Magento 1 stores “Cardbleed”: a skimmer injected into the standard prototype.js file on end-of-life Magento 1 stores over one weekend, the largest campaign Sansec had recorded. Entry vector unconfirmed; a Magento 1 exploit had been offered for sale weeks earlier. Sansec
2019-12 to 2020-01 E-commerce sites in Indonesia, Australia, Europe, South America and the US Operation Night Fury: three suspects arrested in Indonesia; Group-IB ties them to the GetBilling skimmer family. INTERPOL, Group-IB
2018-11 Umbro Brasil online store Two competing skimmer groups on the same Magento store; the second alters card numbers so the first steals useless data. Malwarebytes
2018-06 to 2018-09 British Airways Attackers enter through a supplier’s account without MFA, move through BA’s network and plant a skimmer on the payment page; about 380,000 cards stolen. RiskIQ attributed it to Magecart; the UK ICO fined BA £20 million in 2020. The Register
2018-02 to 2018-06 Ticketmaster Skimming code delivered through a compromised third-party chatbot on payment pages; about 66,000 cards had to be replaced. The UK ICO fined Ticketmaster £1.25 million in 2020. The Register

Target vectors risk profile

Retail/POS Payments Software supply chain Technology/SaaS Transportation/logistics Government Espionage Ransomware/extortion
High High High Medium Medium Low N/A N/A

Malware and tools

Name What it does Public detection Hunt Leads Reports
Plausible tracker skimmer (unnamed) Obfuscated JavaScript added to an analytics tracker; activates only on checkout pages and sends card data and CPF numbers to a short .is domain Indicators in Sansec’s report 4 Hunt Leads Sansec
Cardbleed skimmer Keylogger injected into Magento 1’s prototype.js that loads checkout-only skimming code from an attacker domain Indicators in Sansec’s report Sansec
CosmicSting-era skimmers Several groups’ skimmers using XOR or whitespace encoding, websocket loaders and short exfiltration paths Indicators in Sansec’s report Sansec
GetBilling JavaScript sniffer family that steals payment card and personal data from checkout pages None published Group-IB
Disguised analytics skimmers Skimmers hidden in image files or posing as Google Analytics and Meta Pixel scripts See Microsoft’s report Microsoft

Reports

Date Source Report
2026-10-26 Sansec Notorious Brazilian Magecart group hijacks Convertr checkouts via outdated Plausible install
2024-10-01 Sansec Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns
2022-11-15 Sansec Adobe Commerce merchants to be hit with TrojanOrders this season
2022-05-23 Microsoft Beneath the surface: uncovering the shift in web skimming
2020-11-13 The Register Ticketmaster cops £1.25m ICO fine for 2018 Magecart breach
2020-10-16 The Register British Airways fined £20m for Magecart hack that exposed 400k folks’ credit card details
2020-09-14 Sansec Cardbleed: 3% of Magento install base hacked
2020-01 INTERPOL INTERPOL supports arrest of cybercriminals targeting online shopping websites
2020-01-27 Group-IB Group-IB helps take down a cybergang behind the infection of hundreds of websites
2018-11-20 Malwarebytes Web skimmers compete in Umbro Brasil hack
2018-11-13 RiskIQ and Flashpoint Inside Magecart: a Flashpoint and RiskIQ joint report

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2026-8467 (suspected) 9.5 (CVSS 4.0, CNA) Critical Phenix Digital (phoenix_storybook) phoenix_storybook, as bundled in Plausible Community Edition 3.0.0 to 3.2.0 No
CVE-2024-34102 9.8 Critical Adobe Adobe Commerce and Magento Open Source Yes
CVE-2022-24086 9.8 Critical Adobe Adobe Commerce and Magento Open Source Yes

If you’re in their sights

Do this now

  1. Patch your store platform fast and get off end-of-life versions. Skimming groups mass-exploited Magento and Adobe Commerce bugs within weeks, and after CosmicSting you also need to rotate the store’s encryption keys, not just patch.
  2. Inventory every third-party script on your checkout pages (analytics, chat, tag managers) and lock them down with a Content Security Policy and Subresource Integrity where you can. One compromised shared script can skim every store that loads it.
  3. Monitor checkout pages for unexpected changes, both in the browser and in server-side files, and alert on payment pages sending data to domains you don’t recognize.
  4. Put MFA on store admin panels, hosting accounts and supplier access. Several of the biggest skimming breaches started with a password, not an exploit.

Compiled from Sansec, RiskIQ and Flashpoint, Microsoft, Malwarebytes, Group-IB, INTERPOL and The Register, plus ThreatRoundup reporting. Last reviewed November 1, 2026.

ThreatRoundup coverage

1 of these story has Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.