Mo Money, Mo Magecart

This report documents a Magecart web-skimming campaign that injected JavaScript skimmers into online store checkout pages to steal payment and billing data and exfiltrate it to attacker-controlled domains and IP addresses; the author pivoted from an initial compromised French-Canadian shoe store to enumerate multiple skimmer domains, associated IPs, a Sage Pay phishing page, and related IOCs, and recommends patching, strong admin authentication, and deploying a WAF.