Magecart Hackers Abuse Google Tag Manager to Inject Credit Card Skimmers

Security researchers at Sucuri tracked an active Magecart-linked campaign (attributed to ATMZOW) that hides payment-card skimmers inside malicious Google Tag Manager containers to exfiltrate checkout data; the campaign uses heavy obfuscation, rotating lookalike CDN domains (registered in batches via Hostinger), Cloudflare-protected infrastructure, and persistent reinfection via replacement GTM containers, and the report provides multiple GTM container IDs, domains and IPs as IoCs.