Magecart hits again

This Zscaler ThreatLabZ report analyzes ongoing Magecart web-skimming campaigns targeting online shopping sites: attackers inject JavaScript that captures PII and payment information before form submission and exfiltrates data (Base64-encoded) via GET requests to attacker-controlled gates. Two main cycles are described—skimmers loaded from other compromised sites and from newly registered domains—and the report includes common skimmer URL patterns, examples of reused skimmer file locations, and a list of malicious domains and sample paths to support detection and mitigation.