Sneaky Skimmer Malware Targets Magento Sites Ahead of Black Friday

Security researchers at Sucuri identified a Magento-targeting card‑skimming campaign that injects obfuscated JavaScript into checkout pages (triggering on URLs containing "checkout" but excluding "cart") to capture credit card and billing data, then JSON-encodes, XOR-encrypts (key: "script"), Base64-encodes, and beacons the data to attacker-controlled domains such as staticfonts.com and dynamicopenfonts.app; the malware also collects additional customer data via Magento APIs. Sucuri recommends regular security audits, deployment of a robust WAF, timely patching of plugins/themes, strong credentials, and file integrity monitoring to detect and prevent such skimmers.