MageCart Campaign Targets eCommerce Platform

Zscaler ThreatLabZ describes an ongoing Magecart campaign that compromises e-commerce sites by injecting obfuscated JavaScript skimmers which capture payment and personal data and exfiltrate it to attacker-controlled domains; the report includes screenshots, deobfuscated code, hosting details (AS24936, Moscow), newly registered malicious domains, observed campaign activity, and IOCs (e.g., 83.166.243.206 and mage/mage.js and mail2.php paths), and provides references and monitoring guidance.