Magecart Attacks in 2021

Zscaler ThreatLabZ details a surge in JavaScript skimmer (Magecart) campaigns that compromise e-commerce platforms to exfiltrate payment card data. Attackers increasingly use newly registered domains (NRDs) that are lexically similar to legitimate services, host malicious scripts on CDNs/cloud services or compromised third-party scripts, and abuse analytics/communication services (e.g., Google Analytics, Telegram) to evade detection; the report includes case studies with specific domains, IP addresses, Base64-encoded exfiltration URLs, and recommendations to mitigate such skimmers.