Hackers Leverage Ethereum Blockchain for E-commerce Skimming in HexMage Campaign

A sophisticated and evolving Magecart campaign, identified as HexMage, has been discovered to be leveraging the Ethereum blockchain to facilitate the theft of sensitive credit card data from unsuspecting online shoppers. This campaign has compromised more than 40 e-commerce websites across at least 15 countries since approximately April 2026, targeting popular platforms such as WooCommerce, PrestaShop, Magento, and standard WordPress installations. The attackers' innovative approach involves using Ethereum's Sepolia testnet to host malicious JavaScript loaders, which then query smart contracts to dynamically retrieve disposable domain names for downloading payment skimmers.

The attack chain begins with the injection of a malicious JavaScript loader disguised as a legitimate Google Tag Manager block onto compromised e-commerce sites. This camouflage makes it difficult for security analysts to detect during routine code reviews. Once a shopper reaches the checkout page, the loader fetches the ethers.js library from a content delivery network and interacts with a smart contract deployed on the Ethereum Sepolia testnet via a public RPC service. The smart contract, in turn, provides a disposable domain name, which the loader uses to download the final payment skimmer payload.

This technique, termed 'EtherHiding' by researchers, allows attackers to use the public blockchain as a resilient directory for their attack infrastructure. Instead of embedding all malicious addresses directly into the code, which could be easily identified and blocked, the attackers can update the domain name stored within the smart contract. This allows them to change their command-and-control infrastructure without needing to modify the malicious code left on the compromised websites, significantly frustrating traditional blocking methods.

While similar blockchain-based recovery mechanisms have been observed in other cryptocurrency-related malware operations, HexMage represents a novel application of this strategy to web-based payment theft. The dynamic nature of the infrastructure makes it challenging for defenders to keep pace. However, security researchers can also leverage this approach by querying public contract data to trace shared ownership, identify related contracts, and uncover malicious infrastructure before it is actively used in attacks.

Once the payment skimmer is delivered, it presents a convincing fake form over the legitimate payment area when a shopper opts to pay by card. This form is capable of capturing a wide range of sensitive information, including card numbers, expiry dates, CVV codes, cardholder names, and billing email addresses. The stolen data is then exfiltrated in Base64-encoded form. Crucially, after data collection, the skimmer restores the original payment page, allowing the legitimate purchase to complete, often leaving the victim unaware that their financial details have been compromised.

Researchers from Confiant, who identified the campaign, noted that the attackers also employ variants that bypass the blockchain entirely, embedding the skimmer URL directly within encoded page code. This highlights the need for a multi-layered defense strategy. Defenders are advised to monitor for suspicious fake tag blocks, unusual ethers.js requests, and unexpected checkout scripts. Comprehensive monitoring of server-side changes, plugins, administrator accounts, and all scripts loaded during the checkout process is essential.

For shoppers, a successful transaction is not a guarantee of security. Any customer who has used a credit card on a merchant site later confirmed as compromised should promptly contact their card issuer, monitor for fraudulent charges, and be prepared to replace their card if necessary. The HexMage campaign serves as a stark reminder of how familiar online retail environments can be transformed into effective data collection points when attackers exploit resilient and novel infrastructure like the blockchain.