GOOGLE-ABUSING MAGECART CAMPAIGN RUNS 18 MONTHS AND KEEPS GETTING MORE SEVERE
A Google-abusing Magecart campaign first exposed by Source Defense in late 2024 has continued to evolve, and the risk is no longer just that attackers found a clever way to steal payment data. The bigger concern is that this campaign has remained active for more than 18 months while becoming more evasive, more targeted, and more difficult for standard browser defenses to stop. Instead of using obvious malicious script injections, the latest variants abuse trusted Google infrastructure, broken image error events, and carefully selected exfiltration paths to make the attack look like ordinary browser activity. For ecommerce businesses, that creates a serious client-side risk: payment data can be stolen directly from the shopper’s browser before it ever reaches the secure web server or payment processor.
Attack details
Source Defense’s original November 2024 analysis documented a sophisticated exploitation chain that abused Google infrastructure as part of a Magecart-style attack. Since then, the campaign has moved from clever to more severe. Several ecommerce victims have faced continuous or recurring attacks for roughly a year and a half, creating sustained exposure for payment data, personally identifiable information, and checkout activity.
The newer variant avoids the more familiar pattern of injecting a direct script from an obviously suspicious domain. Instead, attackers inject HTML that uses a broken image and an onerror event to trigger a callback through a trusted Google OAuth-related endpoint. That callback returns attacker-controlled JavaScript from a domain many sites already allow because they depend on Google services.
The payload then reconstructs additional malicious logic, manipulates the checkout page, and presents shoppers with a fake payment form that looks legitimate.
The stolen data is not always sent to the same place. In some cases, it is routed to dedicated attacker infrastructure. In others, it is sent through compromised legitimate domains, WebSockets, or even WebRTC connections to blend with clean traffic and bypass defenses that focus only on known bad script sources.
How Source Defense protects you
This campaign highlights exactly why client-side security needs to inspect behavior inside the browser, not just trust where a script appears to come from. Source Defense protects payment pages by monitoring what scripts actually do during the shopper’s session, including whether they access PCI data, execute risky functions, use browser storage, or transfer sensitive information to unauthorized destinations. That behavior-based visibility is especially important when attackers abuse trusted services like Google, tailor a single exfiltration method to each victim, or send stolen payment data through compromised legitimate infrastructure. Source Defense helps secure sensitive data at the point of input, before it can be harvested from the browser, while supporting PCI DSS 4.0.1 requirements for payment page script control and change detection.
How Source Defense alerts you
Source Defense surfaces the browser-side behaviors that indicate an active skimming attempt, even when the attack is routed through trusted or trusted-looking infrastructure. For this campaign, relevant alerts may include:
- Sending data to a blacklisted domain
- Loaded from a blacklisted domain
- Accessing PCI data
- Accessing PII data
- Accessing credential data
- Accessing data
- Transferring data
- Executing risky actions, including eval, setTimeout, new Function, and setInterval
- Using browser storage
These alerts can be sent by email and/or webhook, depending on configuration.
Key takeaways
The evolution of this Google-abusing Magecart campaign shows why CSP, SRI, WAFs, and server-side logs are not enough on their own. A CSP may trust Google because the business depends on Google services. SRI is difficult to apply to dynamic third-party content. A WAF may never see data stolen directly from the shopper’s browser. Server-side logs may show what looks like a normal checkout session, even while the browser is being manipulated in real time. Source Defense closes that client-side visibility and control gap by helping organizations detect and block unauthorized script behavior before data exfiltration occurs, extending protection to the part of the payment journey attackers are increasingly targeting.
PCI DSS 4.0 makes client-side security a priority.
Source Defense delivers a solution for 6.4.3 and 11.6.1 without adding a burden to your security teams.