Magecart Campaign Uses Google Tag Manager To Steal Credit Card Data

Researchers report a Magecart campaign (linked to the ATMZOW skimmer) that weaponizes Google Tag Manager to inject highly obfuscated JavaScript skimmers into e-commerce sites, stealing customer credit card data; attackers use a 40-domain infrastructure with randomized domain selection and several GTM container IDs, and several fake analytics domains and container IDs are listed as IOCs.