- The Mess: A Magecart campaign dubbed HexMage is using Ethereum smart contracts to hide the infrastructure that delivers payment-card skimmers to compromised online stores. Researchers identified 40+ affected e-commerce sites across at least 15 countries.
- The Damage: Shoppers can enter card numbers, CVVs and billing information into what looks like a legitimate checkout while malicious JavaScript silently captures the data.
- The Fix: Audit checkout JavaScript, Google Tag Manager containers and server files for unauthorized code, and monitor unexpected Ethereum RPC activity and smart-contract lookups from storefronts.
Magecart has found a new place to hide.
Not a bulletproof server.
Not a compromised CDN.
Ethereum.
HexMage is abusing smart contracts on the Ethereum Sepolia testnet to help deliver payment-card skimming code to compromised online stores.
The blockchain isn’t storing the entire attack.
It’s being used as a directory.
And that’s enough.
The Checkout Is Already Compromised
The campaign targets legitimate e-commerce websites, primarily WooCommerce, but researchers also found victims running PrestaShop, Magento and WordPress.
Attackers inject JavaScript into the merchant’s site.
The code can be disguised as something much less interesting — including a Google Tag Manager block.
A shopper arrives.
The store looks normal.
The checkout works.
The payment goes through.
But something else is happening inside the browser.
The skimmer is watching the payment fields.
Ethereum Becomes the Middleman
Traditional Magecart infrastructure usually looks like this:
Compromised store → malicious domain → skimmer
HexMage adds another layer:
Compromised store → Ethereum RPC → smart contract → delivery domain → skimmer
The injected JavaScript loads the legitimate ethers.js library and communicates with a public Ethereum Sepolia RPC endpoint.
It then queries an attacker-controlled smart contract.
The contract returns information identifying the next-stage delivery infrastructure.
The browser follows the instructions.
The skimmer arrives.
The blockchain has done its job.
Why Use a Blockchain?
Because taking down a domain is easy compared with changing data stored on a blockchain.
A conventional Magecart domain can be reported.
The host can be suspended.
DNS can be blocked.
The server can disappear.
A smart contract is different.
The attackers can keep the contract available and change the information it returns.
That gives HexMage an additional layer of indirection between the compromised store and the final payload.
The blockchain isn’t necessarily the weapon.
It’s the dead-drop.
One Wallet, Hundreds of Contracts
This isn’t a one-off experiment.
Researchers linked the campaign’s infrastructure to a single Ethereum wallet that deployed at least 144 matching smart contracts between March and July 2026. Later tracking showed the associated wallet had reached 156 contracts by August 23.
That’s a lot of disposable infrastructure.
And it makes blocking one contract far less useful.
The attacker can simply move to another.
The campaign was observed operating from approximately April 2026, with more than 40 compromised stores identified across at least 15 countries.
The Victim Doesn’t Need to Download Anything
That’s what makes Magecart so effective.
The shopper doesn’t need to install malware.
There is no suspicious executable.
No browser extension.
No fake antivirus warning.
The malicious code runs as part of the checkout experience.
The customer sees the store they intended to visit.
The payment form appears legitimate.
The browser sends the card information.
And the skimmer copies it.
Researchers observed the campaign capturing payment and billing information including card numbers, expiration dates, CVVs and related checkout data.
The legitimate transaction can still complete.
That’s deliberate.
A failed payment would immediately make the victim suspicious.
A successful payment keeps the operation quiet.
WooCommerce Is Sitting in the Crosshairs
The majority of identified victims use WooCommerce.
That’s not surprising.
WordPress and WooCommerce installations are everywhere, and compromised plugins, credentials and server-side access provide plenty of opportunities to inject malicious code.
PrestaShop and Magento are also affected.
The common factor isn’t the CMS.
It’s the checkout.
If attackers can modify the JavaScript that reaches the payment page, they don’t necessarily need to compromise the payment processor.
They compromise the merchant’s browser-facing code instead.
The Blockchain Doesn’t Make the Attack Invisible
HexMage may make takedowns harder.
It doesn’t make the attack undetectable.
The malicious loader still has to execute.
The browser still has to contact infrastructure.
The compromised website still has modified files.
And the checkout still has to load code that shouldn’t be there.
That gives defenders several places to look.
Unexpected JavaScript.
Unknown Google Tag Manager containers.
New PHP files.
Modified theme files.
Suspicious ethers.js usage.
Unexpected Ethereum RPC requests.
The trick is understanding that blockchain traffic doesn’t automatically mean cryptocurrency activity.
In this case, the browser may be using Ethereum as malware infrastructure.
The Attacker Can Change the Destination
This is arguably the cleverest part.
The compromised store doesn’t have to contain the final skimmer domain.
It can contain the logic required to ask the smart contract where to go.
The contract provides the destination.
The browser retrieves the next stage.
If the delivery domain is blocked, the attacker can update the contract.
The compromised merchant may not need to be touched again.
That creates a resilient delivery chain.
Magecart Just Got a More Persistent Address Book
HexMage isn’t the first example of criminals abusing blockchain infrastructure.
The technique is known as EtherHiding.
But applying it to payment-card skimming creates an especially nasty combination.
The merchant gets compromised.
The shopper becomes the target.
The browser becomes the execution environment.
And Ethereum becomes part of the delivery mechanism.
Every layer has a different defender.
That’s exactly what attackers want.
Bugstoday Opinion
Magecart has never needed sophisticated malware.
It needed access to the checkout.
HexMage shows what happens when attackers add a little infrastructure engineering.
Instead of hard-coding the skimmer’s destination, they ask Ethereum.
Instead of relying on one server, they deploy a fleet of contracts.
Instead of breaking the payment processor, they compromise the store the customer already trusts.
The result is almost invisible to the shopper.
You don’t see the attack.
You don’t download anything.
You simply pay for something online.
And somewhere between clicking Pay and receiving the confirmation, your card details can disappear.
Bugstoday verdict: the blockchain isn’t just for crypto anymore. If attackers can turn Ethereum into a malware address book, e-commerce defenders need to start treating smart-contract lookups as part of the web attack surface.
Today’s Bugs. Tomorrow’s Breaches.
