MAGECART EXPANDS TO 97 ETHEREUM CONTRACTS AND ADDS ENCRYPTION

Source Defense has now connected hundreds of compromised websites worldwide to 97 Ethereum Sepolia smart contracts in the Magecart campaign we first reported in our June 23, 2026 article, New Magecart Attack Uses Blockchain to Hide Skimmer Infrastructure. In that original attack, attackers used the blockchain to hide the domain delivering their payment skimmer.

The campaign has since evolved to make that infrastructure harder to uncover. Newer contracts return encrypted data that can only be resolved using a password embedded in malicious code on the compromised website, rather than a value researchers can simply decode from the blockchain. The victim’s browser combines those two pieces at runtime to discover and load the next stage, making the campaign significantly harder to map from blockchain data alone.

Attack details

The attack begins with malicious JavaScript added to a compromised e-commerce website. The code is shaped to resemble a Google Tag Manager initialization, including familiar dataLayer behavior and GTM-style identifiers, but the observed snippets do not use those identifiers to load Google’s legitimate Tag Manager resource. Instead, the loader imports the legitimate ethers.js library and communicates with Ethereum’s Sepolia test network.

The loader connects through public JSON-RPC providers, with observed examples including 0xRPC, 1RPC, Pocket Network, SubQuery, and PublicNode. It then calls a public getText() method on an attacker-controlled smart contract. The contract functions as a remotely controlled dead drop: rather than placing the active skimmer domain directly on the compromised website, the attacker stores information in the contract that tells the browser where to retrieve the next stage.

Earlier versions returned a Base64-encoded domain. Once researchers identified a contract address, they could query the contract and decode its contents without visiting an active victim site.

The upgraded version changes that relationship. The contract now returns encrypted data containing a salt, initialization vector, and AES-GCM ciphertext. A password stored in the malicious website loader is used with PBKDF2-SHA-256 to derive a 256-bit AES key. The browser decrypts the contract value, Base64-decodes the resulting plaintext, appends a loader-specific path, and dynamically injects the final skimmer script.

The browser therefore has everything needed to complete the attack, but an investigator examining only the blockchain does not. Source Defense Research recovered 48 decryption keys associated with encrypted variants. The remaining contracts in the 97-contract dataset use the earlier method and can be decoded without a key.

Source Defense has published the full list of identified Sepolia contracts and associated domains gathered during this investigation, providing defenders and researchers with the known infrastructure connected to the campaign.

This separation creates a practical defensive challenge. The attacker can update the contract’s stored value and redirect infected websites to replacement infrastructure without changing the malicious loader already present on those sites. Blocking one payload domain can interrupt the current chain, but the underlying loader can remain capable of resolving a new destination later.

The campaign also demonstrates why familiar-looking code deserves behavioral scrutiny. A snippet that resembles GTM can still import an unrelated library, query a blockchain network, derive cryptographic keys, and create a new script element whose destination does not exist in readable form until the page is already running.

How Source Defense protects you

Source Defense provides runtime control and visibility inside the browser, where this attack ultimately comes together. In a Magecart campaign like this, it can help protect sensitive data such as payment-card details while also surfacing suspicious behaviors such as risky JavaScript execution, unexpected data access, and data being sent to unfamiliar destinations.

That matters when the active payload host is resolved only at runtime and can be changed through a smart contract. Rather than depending on a fixed domain, URL, contract address, or hash, Source Defense evaluates what scripts are doing in the browser and applies policies accordingly.

This approach helps organizations maintain protection as attackers rotate infrastructure, introduce new payloads, or disguise malicious activity behind familiar services and legitimate browser functionality. The focus remains on the behavior that creates risk, even when the indicators behind it change.

How Source Defense alerts you

Source Defense provides browser-level behavioral context that can surface suspicious script activity even as the campaign’s infrastructure changes.

Relevant alerts can include Loaded from a blacklisted domain when a malicious payload is retrieved from a known blacklisted destination, Sending data to a blacklisted domain when an unauthorized script sends information to a known malicious destination, and Sending data to other when information is sent to a destination outside the expected website or script relationships.

Source Defense can also alert on sensitive-data access, including Accessing PCI data, Accessing PII data, Accessing credential data, or the broader Accessing data behavior when applicable. Other relevant behavioral indicators may include Executing risky actions such as eval, setTimeout, new Function, or setInterval, as well as Using browser storage or Using 1st party cookies when those behaviors occur.

Teams can review activity through dashboard summaries and the bell notification center, including “Found in blacklists” and “Script behaviors” information where applicable. Email and webhook notifications can extend those alerts into existing security workflows so suspicious client-side activity receives attention without relying on someone to manually inspect page source or blockchain state.

Key takeaways

Magecart has not abandoned its Ethereum-based routing technique. It has made the technique harder to investigate. Source Defense’s earlier research showed how attackers could use Sepolia smart contracts to hide skimmer infrastructure; the latest version encrypts the contract’s useful content and stores the missing secret separately on compromised websites.

That evolution exposes the limits of indicator-focused defenses. A domain, contract ID, URL, or hash can become stale while the underlying attack mechanism remains active. The contract owner can change where infected browsers are sent without reinjecting the loader into every compromised website.

CSP and SRI provide browser-enforced controls focused on allowed sources, policy rules, or resource integrity, but fixed allowlists and hashes do not by themselves explain what approved or dynamically loaded JavaScript does after execution. WAFs and server-side monitoring operate outside the shopper’s browser and therefore do not directly control the runtime behavior assembled there. Source Defense adds that missing layer by enforcing script behavior inside the browser, including access to sensitive data and unauthorized outbound activity.

The campaign now spans 97 identified Sepolia contracts and hundreds of compromised websites, but its most important development is architectural: the useful indicator is deliberately split across multiple systems and reconstructed only at runtime. Defenders need protection that follows the behavior, not just today’s infrastructure.

Source Defense controls that behavior where the attack ultimately has to succeed, helping stop browser-based skimming and protect customer data even as attackers change domains, contracts, encryption keys, and delivery paths.