“Magecart” Strikes Again: Long-Running Web Skimming Campaign Targets Global Payment Networks

A long‑running Magecart web‑skimming campaign (active since Jan 2022) has been compromising e‑commerce sites using WooCommerce/Stripe to inject malicious JavaScript that replaces legitimate Stripe payment forms with fake, localized iframes to harvest and exfiltrate encrypted credit card details; the malware uses MutationObserver and a wpadminbar self‑destruct check to evade detection and uses resilient (bulletproof) hosting for its C2 infrastructure.