Magecart Hackers Uses 100+ Domains to Hijack eStores Checkouts and Steal Card Data

A long-running, infrastructure-driven Magecart campaign has compromised at least 17 WooCommerce e-stores across multiple countries since early 2024, using a layered JavaScript loader and over 100 malicious domains to inject high-fidelity fake payment UIs (notably impersonating Redsys and PayPlug) and exfiltrate full card data via encrypted WebSocket channels; the operation also pushed malicious Android APKs and demonstrates persistent, resilient command-and-control and multi-language targeting.