Magecart Attackers Abuse Google Ad Tool to Steal Data

Sucuri researchers uncovered an active Magecart campaign where attackers embed obfuscated, Base64-encoded JavaScript payloads inside Google Tag Manager tags on Magento e-commerce sites to skim payment card data; at least six sites were affected and investigators also found an undeployed backdoor. Recommended actions include removing suspicious GTM tags, performing full site scans to remove skimmers and backdoors, and updating and monitoring Magento installations and GTM activity.