Reported by 2 outlets

Timeline

1. original reporting

   Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online Stores

   gbhackers.com · 43d ago · August 31st, 2026

   A Magecart campaign dubbed HexMage has compromised more than 40 e-commerce storefronts across at least 15 countries, using Ethereum smart contracts as a resilient delivery mechanism for payment-card skimmers. The operation blends traditional client-side checkout theft with EtherHiding, allowing attackers to conceal and rotate skimmer infrastructure through Ethereum’s Sepolia testnet. Because the malicious code is […] The post Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online Stores appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Turn Ethereum Blockchain Into a Card-Skimming Network Targeting Online Shoppers

   cyberpress.org · 43d ago · August 31st, 2026

   Cybercriminals are abusing Ethereum blockchain technology to steal payment-card details from online shoppers. The campaign, tracked as HexMage, compromises legitimate e-commerce websites and injects malicious JavaScript into checkout pages. The attackers use a technique called EtherHiding , which stores or retrieves attack information through blockchain smart contracts. Instead of hosting the complete skimmer on a normal malicious server, the attackers keep a delivery domain inside an Ethereum Sepolia testnet contract. This makes the infrastructure more resilient because defenders cannot easily remove blockchain data. Researchers identified more than 40 affected merchant websites across at least 15 countries since April 2026. Most of the compromised stores use WooCommerce, although some run PrestaShop, Magento, or standard WordPress installations. The attackers appear to target legitimate businesses, placing both merchants and their customers at risk. Ethereum Card-Skimming Network The malicious code is injected server-side into the victim merchant’s website. It hides inside a fake Google Tag Manager block, making it look like normal advertising or analytics code. However, the fake block does not load the legitimate Google Tag Manager script. When a shopper opens the checkout page, the hidden loader downloads the ethers.js Ethereum library from the legitimate jsDelivr content delivery network. A server-side compromise (phase 1), the EtherHiding delivery that runs entirely in