The cybersecurity landscape continues to change as attackers find new ways to hide malicious infrastructure.
A recent Magecart campaign known as HexMage demonstrates just how far this evolution has gone. Instead of relying entirely on conventional command and control servers, attackers are abusing Ethereum smart contracts to help deliver payment skimming code to compromised online stores.
Researchers have identified more than 40 affected e commerce websites across at least 15 countries, with WooCommerce representing a significant portion of the observed victims. Other affected environments have included platforms such as PrestaShop, Magento, and WordPress.
The incident is a significant warning for retailers, payment providers, financial institutions, and organizations responsible for protecting online customer transactions.
How the Attack Works
The campaign follows a multi-stage approach.
Attackers first compromise legitimate e commerce websites and inject malicious JavaScript into the shopping environment.
The injected code can then use blockchain infrastructure to determine where the next stage of the attack should be retrieved.
The basic attack chain can be understood as:
Compromised Website → Malicious JavaScript → Ethereum Smart Contract → Delivery Infrastructure → Payment Skimmer
This approach creates additional separation between the compromised website and the final malicious payload.
Instead of embedding a fixed malicious server address directly into the website code, attackers can use a smart contract to provide updated information about where the next stage should be obtained.
Why Ethereum Is Being Abused
The Ethereum blockchain was not compromised.
Instead, attackers are abusing legitimate blockchain functionality as part of their malicious infrastructure.
The campaign has reportedly used the Ethereum Sepolia testnet and attacker controlled smart contracts to retrieve information needed for the next stage of the attack. Researchers also identified a wallet associated with numerous related contract deployments.
This creates a challenge for defenders.
Traditional malicious infrastructure can sometimes be disrupted by:
• Blocking domains
• Taking down servers
• Suspending hosting accounts
• Blocking IP addresses
• Removing malicious DNS records
Blockchain based infrastructure introduces another layer because information stored on a distributed ledger can remain available even when conventional infrastructure is taken offline.
The Checkout Page Becomes the Target
The ultimate objective remains familiar.
Steal payment information.
Once the malicious code reaches the checkout environment, attackers can inject or manipulate payment elements to capture information entered by customers.
Potentially targeted information can include:
• Payment card numbers
• Expiration dates
• CVV information
• Cardholder names
• Billing information
• Other checkout data
• Device or browser information
The danger is that the shopper may see what appears to be a normal checkout experience.
There may be no ransomware message.
There may be no suspicious application installed on the customer’s device.
The theft can happen directly inside the browser during a legitimate transaction.
This is one of the reasons Magecart style attacks remain a serious threat to online retailers.
More Than a Website Security Problem
Organizations often focus on protecting their web servers, databases, and administrative accounts.
However, modern e commerce security must also consider what happens inside the customer’s browser.
A compromised third party script or injected JavaScript can potentially manipulate the checkout experience even when the underlying payment infrastructure remains operational.
Security teams should therefore monitor:
• Client side JavaScript
• Third party scripts
• Payment forms
• Dynamic DOM changes
• External network requests
• Content Security Policy violations
• Unexpected blockchain activity
• Browser telemetry
• JavaScript integrity
• Changes to checkout workflows
Trusted Services Can Also Become Part of the Attack Chain
Another important lesson is that attackers do not always need to host every component themselves.
The campaign has been reported to use legitimate JavaScript infrastructure and public blockchain RPC services as part of its delivery mechanism.
This creates a challenge for traditional security controls.
A request to a legitimate CDN does not automatically mean that the code being loaded is safe.
Likewise, communication with a public blockchain service is not automatically malicious.
The security question becomes:
Why is this application communicating with that service, and what is the application doing with the response?
This is where behavioral monitoring becomes increasingly important.
Why Traditional Domain Blocking Is Not Enough
Security teams have historically relied heavily on indicators such as:
• Malicious IP addresses
• Suspicious domains
• Known malware hashes
• Blacklisted URLs
These indicators remain valuable, but they can become less effective when attackers dynamically retrieve infrastructure information.
If the malicious website does not contain a permanent destination, blocking one server may not stop the complete attack.
The HexMage campaign demonstrates why organizations need to understand the attack architecture rather than relying only on static indicators.
The Importance of Client Side Security
For organizations operating online stores, the browser based portion of the application deserves the same level of attention as backend infrastructure.
Security programs should consider:
JavaScript Integrity
Monitor changes to scripts involved in authentication, payments, and checkout workflows.
Third Party Script Management
Maintain an inventory of external JavaScript dependencies and regularly assess their security.
Content Security Policies
Implement appropriate Content Security Policy controls to restrict unauthorized script execution and external connections.
Continuous Monitoring
Monitor checkout pages for unexpected changes and suspicious outbound communication.
Web Application Testing
Include client side behavior in penetration testing and application security assessments.
Payment Security
Protect the complete payment environment rather than focusing exclusively on the payment gateway.
PCI DSS Compliance Is Not the Entire Security Strategy
Payment Card Industry Data Security Standard requirements are essential for organizations processing payment information.
However, compliance should not be treated as the final security objective.
Organizations can meet individual compliance requirements while still having weaknesses in their client side application environment.
A mature payment security program should combine:
• PCI DSS controls
• Application security
• Secure development practices
• Client side monitoring
• Third party script governance
• Vulnerability management
• Threat intelligence
• Penetration testing
• Incident response
• Continuous security validation
The objective should be reducing actual risk, not simply completing a compliance checklist.
What E Commerce Organizations Should Do
Organizations operating online stores should consider the following actions:
1. Audit Checkout JavaScript
Review all scripts loaded during the payment process and identify unexpected or unauthorized changes.
2. Monitor External Connections
Investigate unusual connections to blockchain RPC services, unknown domains, or unexpected infrastructure.
3. Implement File Integrity Monitoring
Monitor critical website files and immediately investigate unexpected modifications.
4. Review Third Party Dependencies
Maintain visibility into payment scripts, analytics tools, advertising technology, tag managers, and other external components.
5. Test the Complete Payment Flow
Application security testing should include the customer browser and checkout experience.
6. Monitor Administrator Activity
Compromised CMS or administrator credentials can provide attackers with an entry point into the website.
7. Establish Rapid Response Procedures
Organizations should have documented procedures for isolating compromised web applications, protecting customers, investigating affected transactions, and meeting applicable notification requirements.
Industries That Should Pay Attention
Retail and E Commerce
Online retailers are directly exposed to payment skimming risks. Continuous monitoring of checkout pages, third party scripts, APIs, and web applications is essential.
Financial Services
Banks, payment processors, fintech organizations, and financial technology providers should monitor emerging payment fraud techniques and strengthen controls around digital transaction environments.
Hospitality and Travel
Hotels, airlines, travel platforms, and booking providers process large volumes of customer payment information and should protect both web applications and third party integrations.
Healthcare
Healthcare organizations increasingly operate online payment and patient portals. Protecting payment information and sensitive personal data requires strong application and client side security.
Manufacturing
Manufacturers operating direct to consumer platforms, supplier portals, and online payment systems should consider client side application security and third party software risks.
Government
Government agencies operating public facing portals and payment services should maintain strong web application security, third party dependency management, and continuous monitoring.
Technology and SaaS
Technology providers should assess how their platforms, APIs, JavaScript components, and integrations could be abused as part of broader supply chain attacks.
Blockchain Creates New Opportunities for Threat Intelligence
There is also a defensive lesson in the HexMage campaign.
Blockchain transactions are publicly observable.
Researchers can potentially investigate:
• Wallet addresses
• Smart contract deployments
• Contract relationships
• Transaction patterns
• Contract functions
• Blockchain infrastructure
• Connections between contracts and web domains
The persistence that makes blockchain attractive to attackers can also provide investigators with additional threat intelligence opportunities.
This means cybersecurity teams may increasingly need capabilities that combine traditional web security with blockchain intelligence.
The Bigger Cybersecurity Lesson
The most important takeaway is not that Ethereum is inherently dangerous.
It is not.
The lesson is that attackers are willing to repurpose legitimate technologies for malicious objectives.
Cloud services, content delivery networks, collaboration platforms, APIs, blockchain networks, and other trusted technologies can all become components of an attack chain.
Security teams therefore need to focus increasingly on behavior, context, and relationships between systems.
A website connecting to a blockchain service may be completely legitimate in one environment and highly suspicious in another.
Context matters.
Conclusion
The HexMage campaign demonstrates how payment skimming is evolving beyond traditional malicious domains and servers.
By using Ethereum smart contracts as part of their infrastructure, attackers can introduce another layer of indirection into an already sophisticated Magecart style operation.
For e commerce organizations, this is a reminder that protecting customer payment information requires more than securing the backend.
The browser, checkout page, JavaScript ecosystem, third party services, APIs, and external connections all form part of the payment security environment.
Organizations should adopt continuous monitoring, client side security controls, application testing, third party risk management, threat intelligence, and strong compliance practices to reduce exposure.
The future of e commerce security will depend not only on protecting where data is stored, but also on protecting how data moves through the customer’s browser.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services
COE Security also helps organizations strengthen their e commerce and payment security programs through web application security assessments, client side security testing, API security testing, penetration testing, vulnerability management, third party risk assessments, payment environment assessments, threat intelligence, cloud security reviews, secure software development, continuous monitoring, and compliance readiness.
For retail and e commerce organizations, COE Security helps protect checkout applications, payment workflows, customer information, APIs, third party scripts, and cloud environments against evolving web skimming and application security threats.
For financial services and fintech organizations, we help strengthen payment security, application security, fraud detection, API protection, data governance, and threat monitoring.
For healthcare organizations, we help protect patient portals, payment environments, sensitive personal information, applications, and connected systems.
For manufacturing organizations, we help secure customer portals, enterprise applications, cloud environments, APIs, and connected digital infrastructure.
For government organizations, we help strengthen public facing applications, payment systems, vulnerability management, monitoring, and compliance programs.
For technology and SaaS organizations, we help secure applications, APIs, cloud infrastructure, third party integrations, development environments, and software supply chains.
Our goal is to help organizations identify security gaps, reduce attack surfaces, protect sensitive data, strengthen resilience, and maintain cybersecurity programs aligned with business and compliance requirements.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption, emerging cyber threats, e commerce security, application security, payment security, and practical cybersecurity best practices.
Click to read our LinkedIn feature article