eSkimming Attacks Surge with Evolving Tactics and Ongoing Recovery Challenges

This study tracked 550 previously compromised e-commerce sites across 68 countries for a year and found that eSkimming (Magecart) infections are frequently persistent and adaptive: 18% remained actively infected after a year, 57% of those were re-infected or evolved campaigns, and attackers often shifted payloads between third-party and first-party scripts. The report concludes that point-in-time cleanup and server-side controls are insufficient and calls for continuous client-side runtime visibility and behavior-based controls to prevent payment data exfiltration and durable re-compromise.