Magecart activity and campaign enhancements

This Zscaler ThreatLabZ report analyzes an active Magecart campaign that injects heavily obfuscated JavaScript (including RC4-encrypted and dynamically loaded payloads, and scripts hosted directly on compromised sites) into e-commerce checkout pages to capture and exfiltrate payment card and billing details; it documents injection methods, cookie-based deduplication and fake-field techniques, lists IOCs (malicious domains, URLs and an IP) and enumerates dozens of compromised sites, concluding that Magecart continues to evolve its skimming toolset.